High-performance temporary storage system using Redis. Supports namespaced keys (mema:*), TTL management, and JSON serialization for session context and API...
Security Analysis
medium confidenceThe skill's code and runtime instructions match its Redis caching description and requests only a Redis connection and python; minor metadata inconsistencies and operational cautions remain but the package is internally coherent.
Name/description (Redis-backed cache with mema: namespace) aligns with the included Python script and shell helper. The functionality (set/get/scan/ttl/expire/ping) and declared dependencies (redis, python-dotenv, python3) are appropriate for the stated purpose.
SKILL.md instructs using a .env (env.example.txt) and running the provided cache_manager.py via python3 or scripts/cache.sh which creates a local virtualenv and installs requirements. The script loads environment variables (.env and the process environment) and only communicates with Redis; it does not contact external endpoints beyond the Redis server. Note: example command references $WORKSPACE path — runtime must ensure correct path mapping.
No remote downloads or arbitrary URLs; installation is local pip install -r requirements.txt performed by the provided script or by the SKILL.md metadata. Requirements are standard (redis, python-dotenv). The script will create a .venv directory inside the skill tree to install dependencies.
The runtime requires REDIS_URL (and supports REDIS_HOST/PORT/PASSWORD/DB/timeouts), which is proportional to a Redis cache skill. However, top-level registry metadata lists no required env vars while SKILL.md metadata declares REDIS_URL — this mismatch should be clarified. The script reads .env and environment variables, so any secrets present in .env will be loaded.
always is false and model invocation is allowed (default), which is appropriate. The skill writes a local .venv but does not modify other skills or system-wide agent configurations. No elevated privileges or permanent always-on presence are requested.
Guidance
This skill appears to do what it says: a Redis-backed cache accessed via a local Python script. Before installing, confirm: (1) REDIS_URL points to a trusted Redis instance (a misconfigured or public Redis can leak or accept data); (2) you understand that the skill will read a .env file and environment variables (do not store unrelated secrets there); (3) the script will create a .venv inside the skill directory and install packages from requirements.txt (no external downloads); (4) keys can be up to 512 MiB in value — avoid storing sensitive or large blobs unless intended. Also ask the publisher to fix the metadata mismatch (registry shows no required env vars while SKILL.md requires REDIS_URL) and to confirm the intended workspace path usage ($WORKSPACE). If you need tighter controls, restrict network access to the Redis host and avoid using the cache for secrets or long-term storage.
Latest Release
v1.1.9
Simplified implementation: removed wrapper script, declared dependencies clearly in metadata, and ensured full manifest inclusion. Addressed all audit flags.
More by @1999AZZAR
Published by @1999AZZAR on ClawHub
