redis-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that embed plaintext passwords and credential-bearing URIs (e.g., redis-cli -a myUnguessablePazzzzzword123 and redis://user:password@host:port), which forces any agent reproducing or following those examples to handle or emit secret values verbatim.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged only literal, non-placeholder values that look like real, high-entropy credentials. Specifically:
• references/connection-and-options.md:[255] contains AUTH user ">^8T>6Na{u|jp>+v"55@_" — a random-looking, complex password (high entropy) used literally in an authentication example, so it qualifies as a potential secret.
• redis-cli -a myUnguessablePazzzzzword123 appears literally in SKILL.md:[60] and references/connection-and-options.md:[26]. That value is a concrete password (long/complex-looking). Although it appears in example contexts, it's not a generic placeholder (e.g., "PASSWORD" or "YOUR_API_KEY") and therefore is treated as a literal credential worth flagging.

I ignored obvious placeholders and low-entropy example passwords elsewhere (e.g., >strongpassword, >password, >newpass, "PASSWORD" in URIs, "admin", "password") because they are clearly documentation examples or low-security setup values and are called out in the guidance to be ignored.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes commands that require sudo for installation and multiple administrative Redis operations (creating ACL users, changing config, shutting down/replication commands, reading system files) that modify service and host state and could compromise the machine or services running on it.