Name: redis-security
Rating: 73.6 (1 reviews)
Author: redis

redis-security

Redis security guidance covering authentication (requirepass and ACL users), TLS, ACL-based least-privilege access control, restricting network exposure via bind and protected-mode, firewall rules, and disabling dangerous commands. Use when deploying Redis to production, defining ACL users for an application, configuring TLS connections, locking down a Redis instance behind a firewall, or auditing a Redis deployment for security hardening.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Concise, highly actionable, and well-structured with clean progressive disclosure to real reference files. The main weakness is workflow clarity: destructive operations (rename/disable commands, firewall DROP rules, ACL lockout risk) proceed without explicit validation or verification steps, which caps that dimension.

Suggestions

Add a short hardening sequence with validation checkpoints — e.g., after applying ACL users, connect with each credential to confirm access before deploying; after firewall and rename-command changes, verify the application can still reach Redis and issue the commands it needs.

Include a verification/rollback step for destructive config (rename-command, iptables DROP), such as testing in a staging instance first and noting how to revert if the application breaks.

Add a brief 'verify' callout per section (test auth+TLS handshake, list ACL users to confirm least-privilege, confirm protected-mode/bind took effect) so each hardening step has an explicit success check.

Dimension	Reasoning	Score
Conciseness	Lean and efficient throughout — direct instructions, tight code blocks, and a compact command-category table with no padding about what Redis is; the few rationale lines ('bounds the blast radius') earn their place as security reasoning rather than filler.	5 / 5
Actionability	Fully executable, copy-paste-ready guidance across all sections: redis.conf snippets, a Python client example, ACL SETUSER commands, iptables rules, and rename-command directives covering the common hardening cases.	5 / 5
Workflow Clarity	The three topics are well structured but there is no sequenced hardening workflow and no validation/verification steps (e.g., test the ACL user, confirm connectivity after firewall/rename-command, rollback guidance); the destructive-operation cap holds this at 3.	3 / 5
Progressive Disclosure	A clear overview with three well-signaled, one-level-deep references (auth.md, acls.md, network.md — all present in the bundle), keeping inline content to essentials and deferring detail appropriately.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete capabilities, natural trigger phrases, and a clear what/when structure targeting a well-defined niche. The only minor gap is a lack of synonym/file-extension variants in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions with named mechanisms — 'authentication (requirepass and ACL users)', 'TLS', 'restricting network exposure via bind and protected-mode', 'firewall rules', 'disabling dangerous commands' — with comprehensive coverage and no notable gaps.	5 / 5
Completeness	Explicitly answers both what ('Redis security guidance covering authentication, TLS, ACL-based least-privilege access control, restricting network exposure, firewall rules, disabling dangerous commands') and when ('Use when deploying Redis to production, defining ACL users...') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural trigger phrases users would say ('deploying Redis to production', 'locking down a Redis instance behind a firewall', 'auditing a Redis deployment for security hardening') with good coverage, but lacks synonym/file-extension variants the 5 anchor expects.	4 / 5
Distinctiveness Conflict Risk	'Redis security guidance' is a clear niche with Redis- and security-specific triggers that would not plausibly fire for unrelated skills, giving minimal conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: redis/agent-skills
Path: skills/redis-security/SKILL.md
Commit: 172fb9e

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.