Security audit

Redis

Security checks across malware telemetry and agentic risk

Overview

This Redis skill is mostly a coherent operations guide, but it under-labels commands that can delete or export production data and persists Redis environment observations locally with limited user control.

Install only if you are comfortable with a Redis assistant that may read and update its local Redis memory under ~/Clawic/data/redis-store/. Before using generated redis-cli commands on production, review them carefully, especially any command involving UNLINK, FLUSH*, CONFIG SET, SHUTDOWN, --pipe, --eval, --rdb, or broad SCAN patterns; treat snapshots as sensitive data exports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The blanket statement that everything is safe on a live server unless flagged otherwise is misleading because the document includes unflagged commands that write, delete, execute Lua, or export data. An operator may rely on that safety claim during an incident and unintentionally cause data loss, performance impact, or sensitive data exfiltration.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The example piping scanned keys into xargs with UNLINK performs bulk deletion on a live keyspace but is presented in the 'Walking The Keyspace Safely' section without an immediate destructive-operation warning. Even though UNLINK is less blocking than DEL, it still deletes matched keys and can cause production data loss if a pattern is too broad or mis-typed.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The --rdb example pulls a full snapshot over the network and writes it to local storage, which can expose sensitive in-memory data without warning about privacy, retention, or access controls. In an incident context, responders may copy production datasets to insecure workstations or shared disks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read and later update user-local files under ~/Clawic/data/redis-store without any user-facing notice or consent at the time of access. Even though the files are framed as preferences and memory, this creates a privacy and integrity risk because the agent may silently collect, persist, and reuse local context that the user did not explicitly authorize for the current task.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - `INFO replication` → `role`, connected replicas, whether this is a replica at all - `INFO memory` → `maxmemory`, `maxmemory_policy`, `used_memory`, `mem_fragmentation_ratio` - `INFO persistence` → `aof_enabled`, `rdb_last_bgsave_status`, `loading` - `CLUSTER INFO` → `cluster_enabled:1` settles `topology` without asking Record what these reveal in `~/Clawic/data/redis-store/memory.md`, not in `config.yaml` — observed state is not a declared preference.
Confidence: 89% confidence
Finding: The skill encourages autonomous environment inspection and state recording 'without asking,' including Redis INFO and CLUSTER INFO queries and persisting the results to memory.md. In a Redis administration context, these commands can reveal infrastructure details and operational state, and silently collecting and storing them reduces user control over sensitive system metadata and may normalize unapproved probing of live systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.