redis-tools

Lookup Redis commands by category, test Redis server connections, and monitor database key counts and memory usage, with offline cheatsheet support.

This skill appears coherent: it provides a local Bash cheatsheet and a script that uses redis-cli to test and monitor Redis instances. Before installing or running it: (1) open and read scripts/script.sh in full to confirm there are no hidden network calls (curl/netcat) or external endpoints; (2) do not supply production credentials or passwords unless you trust the script and its source—prefer testing against a local/dev Redis instance first; (3) if you are concerned about the agent initiating network activity autonomously, keep disable-model-invocation or agent autonomous invocation settings restricted; (4) run the script in a sandbox / non-privileged environment if possible. If you want, paste the full script here and I can scan it for risky patterns (egress calls, data exfiltration attempts).

Type: OpenClaw Skill Name: redis-tools Version: 1.0.0 The script `scripts/script.sh` contains a shell injection vulnerability in the `do_test` and `do_monitor` functions. It constructs a command string (`RCMD`) using unvalidated input variables (`host`, `port`, `pass`) and executes it via subshell expansion (`$($RCMD ...)`), which allows arbitrary command execution if malicious arguments are provided. While the tool's stated purpose is benign (Redis management), this architectural flaw poses a security risk.