Redis Skill - 高性能缓存管理

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:18 AM UTC
• Version: 1.0.0

Overview

This is a Redis helper with disclosed setup and command examples; it has normal database-operation risks but no evidence of hidden or malicious behavior.

Before installing, review any sudo, brew, or pip install steps and execute them only in an environment you administer. Treat generated Redis commands as capable of changing or deleting production data, especially CONFIG, EVAL, RESET, and range-delete commands, and confirm the target host, database, and backup posture before running them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:32

Finding

Unpinned Redis Python Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: package.json:32-36 and SKILL.md:67-70
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

package.json:32-36:

json

{
  "id": "redis-python",
  "kind": "python",
  "package": "redis",
  "label": "Install Redis Python Client"
}

SKILL.md:67-70:

bash

**Python client (advanced operations):**
```bash
pip install redis

text

### Technical Analysis

The Skill installs the PyPI `redis` package without specifying an exact version or verifying an integrity hash. Consequently, the artifact installed depends on whichever release the configured package index resolves at installation time.

This makes installations non-reproducible and creates exposure to future upstream compromise, unauthorized package-index substitution, or an unexpectedly malicious or incompatible release. Package installation can execute package build or installation logic, while imported package code runs with the privileges of the process using the Skill.

The package name appears consistent with the official Redis Python client; no evidence of current package impersonation or malicious code was identified. The risk arises from unconstrained future dependency resolution rather than from a confirmed malicious package release.

### Attack Path

1. An attacker compromises the upstream `redis` package, its maintainer account, its dependency chain, or the package index used by the installation environment.
2. The attacker publishes or serves a malicious release under the expected package name.
3. A user or automation framework installs the Skill dependency using `pip install redis` or the unversioned package declaration in `package.json`.
4. The installer resolves the attacker-controlled release because no approved version or integrity hash is enforced.
5. Malicious installation logic or subsequently imported runtime code executes in t
...[truncated 770 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, for example by declaring an exact version rather than the unconstrained redis package name.
2. Maintain dependencies in a lockfile or requirements file generated from reviewed inputs.
3. Require package integrity hashes, such as with a hash-locked requirements file and pip install --require-hashes.
4. Install packages only from an explicitly configured, trusted package index.
5. Review and test dependency updates before changing the approved version.
6. Run installation and Redis operations under a dedicated, non-privileged account with only the necessary filesystem, network, and Redis permissions.
7. Add automated dependency and provenance scanning to detect compromised, vulnerable, or unexpectedly changed releases.
8. Keep SKILL.md and package.json synchronized so both installation mechanisms enforce the same reviewed version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The use of command chaining with '&&' means a single copied command performs multiple privileged actions in sequence, reducing opportunities for user inspection and control. In an installation context this is common, but it still increases the blast radius of mistakes or tampering because both update and install execute under sudo as one flow.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"kind": "system",
        "label": "Install Redis Client",
        "commands": {
          "ubuntu": "sudo apt update && sudo apt install -y redis-tools",
          "macos": "brew install redis"
        }
      },

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation condition is very broad: any mention of Redis, caching, queues, or session storage may trigger the skill. Overbroad triggering increases the chance the agent invokes Redis-affecting capabilities in ambiguous conversations, causing unintended data access or modification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation instructs users to run host-level installation and environment-variable shell commands, which expands the skill from Redis operations into local system administration. In an agent setting, this broadens the action surface and could lead to unauthorized package installation, credential handling, or shell execution on the host when the user only intended Redis assistance.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documentation includes sudo-based package installation, which encourages privileged host execution. In an agent-integrated environment, normalizing sudo commands can lead to unnecessary privilege escalation and expands the blast radius if commands are run automatically or with insufficient review.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt update
sudo apt install redis-tools

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

A second privileged package-install command is included, again instructing root-level modification of the host system. Even if intended for setup, embedding it in a skill increases the risk of privileged execution beyond the Redis task scope.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt update
sudo apt install redis-tools

macOS:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill presents numerous write, delete, config-change, and script-execution commands without strong safety gates or warnings, including CONFIG SET, SLOWLOG RESET, HDEL, ZREMRANGEBYSCORE, and EVAL. In an agent workflow, these operations could be executed against production Redis instances and cause data loss, service degradation, or unauthorized configuration changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The package description is entirely in Chinese and presents the skill's behavior in a single language, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, a language-specific constraint should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The installation command requires sudo, which elevates privileges for package installation. While installing redis-tools is a legitimate dependency, embedding privileged commands in skill metadata increases risk because users or automation may execute them without sufficient review, and any compromise of the package source or command path would run with root privileges.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"kind": "system",
        "label": "Install Redis Client",
        "commands": {
          "ubuntu": "sudo apt update && sudo apt install -y redis-tools",
          "macos": "brew install redis"
        }
      },

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description and the skill instructions are presented in Chinese, which effectively imposes a language choice on users. There is no indication that the skill supports alternate languages or that this locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The distributed lock example embeds shell command substitution using $(date +%s%N), introducing arbitrary shell semantics into a Redis command example. In an agent context this normalizes shell execution and creates a pathway for command-injection style misuse if user-controlled values are later interpolated similarly.

Content

No source excerpt is available for this finding.