redis-pentesting

Warn

Audited by Socket on Oct 16, 2026

2 alerts found:

Securityx2
SecurityMEDIUM
SKILL.md

结论: SUSPICIOUS。该技能的行为与其宣称的 Redis 渗透测试目的一致,但目的本身是为 AI Agent 提供现实可执行的攻击、持久化和 RCE 能力;再叠加第三方 exploit 拉取执行,整体属于高风险 offensive-security skill,而非普通开发辅助文档。

Confidence: 95%Severity: 91%
SecurityMEDIUM
references/redis-techniques.md

The provided artifact is an offensive, highly actionable Redis exploitation guide. It contains concrete instructions and payloads for RCE and persistence (webshell writing, cron persistence, SSH authorized_keys injection), plus native module loading, rogue replication workflows, and SSRF-to-Redis chaining into application execution. While it is not executable code, its distribution as part of a software package is a serious supply-chain security concern because it materially enables unauthorized compromise of Redis and related systems.

Confidence: 78%Severity: 88%
Audit Metadata
Analyzed At
Oct 16, 2026, 05:17 AM
Package URL
pkg:socket/skills-sh/wgpsec%2Faboutsecurity%2Fredis-pentesting%2F@4261f1179d3fb0add8fb7a8f925ed50df827c26c11aee3e2c0395e381067fb26