Redis Commander

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.1

Overview

This skill appears to be a disclosed local Redis admin UI, but it uses weak default credentials and an unpinned container image for a tool that can inspect and modify Redis data.

Review before installing. Use only on a trusted local development machine, set unique COMMANDER_USER, COMMANDER_PASSWORD, and REDIS_PASSWORD values before starting it, avoid exposing the port beyond localhost, stop it when finished, and prefer a pinned Redis Commander image version or digest instead of latest.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: docker-compose.yml:3

Finding

Mutable Container Image Allows Unreviewed Dependency Changes

Content

View full analysis

Vulnerability Details

File Location: docker-compose.yml:3
Vulnerability Type: Unpinned third-party container dependency
Risk Level: Medium

Vulnerable Code:

yaml

image: rediscommander/redis-commander:latest

Technical Analysis

The Redis Commander service uses the mutable latest image tag without pinning a reviewed version or immutable image digest. Consequently, separate deployments of the same project can execute different image contents. The effective container payload can change after this project has been audited without any modification to the repository.

This container receives the Redis password and HTTP authentication credentials through environment variables and is connected to the shared Docker network containing Redis. Therefore, compromise of the upstream repository, registry account, publication pipeline, or mutable tag could cause an attacker-controlled image to execute with direct access to those credentials and network resources.

Attack Path

1. An attacker compromises the upstream image publisher, registry account, or release pipeline, or otherwise causes a malicious image to be published under rediscommander/redis-commander:latest.
2. An operator runs ./run.sh start, which invokes Docker Compose.
3. Docker resolves or pulls the mutable latest image.
4. The malicious container starts on the external shared network.
5. The container reads credentials supplied through its environment and connects to codai_redis:6379.
6. The attacker-controlled code can read or modify accessible Redis data and potentially transmit it through any network route available to the container.

Impact Assessment

Successful exploitation provides code execution inside the Redis Commander container with access to its environment variables and the shared Docker network. This can expose the Redis authentication password, HTTP Basic Auth credentials, and all Redis keys and values author ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Redis Commander to a specifically reviewed release and immutable digest, for example:

  yaml

  image: rediscommander/redis-commander:VERSION@sha256:REVIEWED_DIGEST
  

• Do not use latest in production or shared development environments.
• Adopt an explicit dependency-update process that reviews release notes, verifies image provenance, scans the image for vulnerabilities, and updates the digest through a reviewed change.
• Use registry signature verification or an equivalent image provenance policy where supported.
• Restrict container egress and shared-network access to the minimum required destinations.
• Run the container with additional hardening, such as a read-only root filesystem, dropped Linux capabilities, and a non-root user, where compatible with the image.

T09 · Insecure Skill Coding Practices

Error

• Location: docker-compose.yml:7

Finding

Predictable Default Credentials Protect Redis Administration Interface and Backend

Content

View full analysis

Vulnerability Details

File Location: docker-compose.yml:7-9
Vulnerability Type: Hardcoded and predictable default credentials
Risk Level: High

Vulnerable Code:

yaml

environment:
  REDIS_HOSTS: "local:${REDIS_CONTAINER:-codai_redis}:6379:0:${REDIS_PASSWORD:-redispass}"
  HTTP_USER: ${COMMANDER_USER:-admin}
  HTTP_PASSWORD: ${COMMANDER_PASSWORD:-admin}

The same defaults are explicitly documented in SKILL.md:40 and SKILL.md:56-59, while run.sh:13-16 also describes them as configuration defaults.

Technical Analysis

The service silently falls back to the predictable credentials admin / admin for the Redis Commander HTTP interface and redispass for Redis authentication. A deployment therefore remains usable even when the operator has not provisioned any secrets, making these public, repository-documented values effective credentials.

Binding the web interface to 127.0.0.1 reduces direct remote exposure, but it does not remove the vulnerability. Local users, processes executing on the host, software capable of accessing loopback services, or users with an applicable tunnel or forwarding path can attempt authentication with the known defaults. Containers attached to the relevant shared Docker network may also be able to target Redis directly using the documented default password.

The credentials are additionally supplied as ordinary container environment variables. Any principal with permission to inspect the container configuration may be able to retrieve them through Docker inspection or equivalent runtime interfaces. Such principals often already have substantial Docker access, but environment-based secret handling still increases unnecessary credential exposure.

Attack Path

Redis Commander interface path:

1. An operator starts the service without defining COMMANDER_USER and COMMANDER_PASSWORD.
2. Docker Compose assigns the documented defaults admin and admin ...[truncated 1662 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all credential fallbacks and require explicitly provisioned secrets:

  yaml

  environment:
    REDIS_HOSTS: "local:${REDIS_CONTAINER:?REDIS_CONTAINER is required}:6379:0:${REDIS_PASSWORD:?REDIS_PASSWORD is required}"
    HTTP_USER: ${COMMANDER_USER:?COMMANDER_USER is required}
    HTTP_PASSWORD: ${COMMANDER_PASSWORD:?COMMANDER_PASSWORD is required}
  

• Add startup validation that rejects admin, redispass, empty values, and other known defaults.
• Generate unique, high-entropy credentials for every environment and rotate any deployment that may have used the documented defaults.
• Store secrets in Docker secrets, a protected runtime secret file, or an external secret manager instead of committing them or relying on ordinary environment variables where feasible.
• Replace the documentation’s usable passwords with placeholders and instructions for secure generation.
• Configure Redis ACLs with a dedicated least-privilege account for Redis Commander rather than a broadly privileged shared password.
• Preserve the loopback-only port binding and add host firewall controls where appropriate.
• Restrict membership of the external Docker network and segment Redis from unrelated containers.
• Use TLS or a trusted local reverse proxy with TLS if the interface is ever exposed beyond a strictly local machine.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger set includes broad phrases such as "interface redis" and "admin redis", which can match natural user requests that are not specifically intended to invoke this skill. That can cause unintended activation of a container-management skill and expose a local admin UI with weak default credentials, increasing operational risk even though the skill is meant for local development.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The trigger list includes both Spanish ("abrir redis commander") and English phrases, but the file does not state whether multilingual triggering is intentional or user-selectable. This may violate language/locale policy if the organization expects skills not to force or assume a language mode without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.