Redis Commander

• Outcome: Pass
• Latest audit: May 28, 2026 at 2:42 PM UTC
• Version:
  1.0.1

Overview

This skill coherently starts and stops a local Redis Commander web UI, with the main risks disclosed and bounded to local Docker use.

Install this only for a local development Redis environment you control. Change the default Commander and Redis passwords on shared machines or sensitive data, and stop the container when finished because it is configured to restart until explicitly stopped.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger set includes broad phrases like 'interface redis' and 'admin redis', which can plausibly match ordinary user requests about Redis administration rather than an explicit request to manage this specific local Dockerized UI. In an agent environment, ambiguous activation can cause the wrong skill to run and start/stop services or expose an admin interface unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.