Skill

summarize-database

skill:stackexchange/stackexchange.redis#summarize-database

Profile/summarize a live Redis (RESP) database by sampling — discover key patterns, where data lives by count and by size, and what the values actually are (counters, JSON, XML, blobs, text). Use when asked to summarize, profile, analyze, audit, or characterize a Redis/Valkey/RESP database or its keyspace, understand key naming patterns, or find where memory/data is concentrated.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:16 UTC at ee47e53

findings

medium

highest severity

threat classes

1,071

files scanned

32/32

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.claude/skills/summarize-database:.claude/skills/summarize-database/SKILL.md:111:HIJACK

Security findings 1

Agent hijacking

mediumContextual risklow confidence

SKILL.md directs the agent to load AGENTS.md for 'the broader project context', a file outside the consumed agent surface, so the instructions the agent applies from it at runtime are unreviewed.

.claude/skills/summarize-database/SKILL.md:111

See `AGENTS.md` for the `resp-cli`-over-`redis-cli` preference and the broader project context.

vector:instruction

Counter-argument considered

I tried to kill this as a benign docs cross-reference, but the target is AGENTS.md — an agent-instructions file the artifact does not ship — and the phrase 'the broader project context' invites the agent to adopt unreviewed runtime instructions beyond the declared Redis-profiling capability; no carve-out applies and no shown unit mitigates it, so the low-confidence contextual-risk finding stands.

Open questions 4

What the analysis could not settle from the code alone.

The detector leads for units SRC:03b83a3f0a3de6be, SRC:ee2fb86b368e2340, and SRC:8414ad2acb156ff8 could not be confirmed: the claimed sentence 'This is a **read-only, sampling** analysis.' does not appear anywhere in the shown unit text, and every flagged token is benign in context — 'SET' is named only in a prohibition list ('No FLUSHALL/FLUSHDB, DEL, SET, CONFIG SET'), '-p', '[-a', and ']' are flags in the resp-cli usage string, '0' is from 'connected_slaves > 0', and 'randomkey' is a read-onl⟦… 207 more chars …⟧

[invalid file request] Does AGENTS.md contain only the resp-cli-over-redis-cli tooling preference and project context, or any instruction that directs the agent to run commands, read further files, or send data anywhere beyond the declared summarize-database task?

Agent hijacking

[file request AGENTS.md] The skill directs the agent to AGENTS.md for the resp-cli-over-redis-cli preference and 'the broader project context'; does that file contain instructions that steer the agent beyond the declared summarize-database task (HIJACK/TOOLPOISON/MANIP or any other class)?

Agent hijacking

[file request AGENTS.md] SKILL.md directs the agent to 'See AGENTS.md for the resp-cli-over-redis-cli preference and the broader project context' — does AGENTS.md contain only that tooling preference, or does it add instructions that direct the agent to run commands, read further files, or send data anywhere?

Agent hijacking

Execution chain 6

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 1

.claude/skills/summarize-database/SKILL.md:18 · instructed

Files written 5

-p

.claude/skills/summarize-database/SKILL.md:32 · instructed

[-a

.claude/skills/summarize-database/SKILL.md:32 · instructed

]

.claude/skills/summarize-database/SKILL.md:32 · instructed

.claude/skills/summarize-database/SKILL.md:21 · instructed

randomkey

.claude/skills/summarize-database/SKILL.md:61 · instructed