An open Redis server is found by internet scanners within minutes, and CONFIG SET dir lets an attacker write a web shell or an SSH key through it. This skill finds that and six other Redis configuration mistakes before your server goes live, and tells you how to fix each one.

Your agent runs a scanner on your redis.conf and valkey.conf files. It reads directives the way Redis does (spaces or tabs, quotes, comments, the last value wins) and works out whether the server is reachable from the network from bind, protected-mode and the ports, and whether a password or ACL is set. It never connects to Redis. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Passwords are never printed.

What it checks

BLOCK (fix before shipping)

• R01: reachable from the network (bind 0.0.0.0, *, or protected-mode no) with no password or ACL

• R02: a weak password: foobared (the redis.conf sample), a common word, or shorter than 16 characters

• R03: dir or dbfilename pointing at a web root, an .ssh or cron folder, or a .php file (the web-shell attack)

REVIEW (check before release)

• R11: CONFIG not renamed or limited for clients that can reach the server

• R12: the plain-text port reachable from the network (no TLS)

• R13: enable-debug-command, enable-module-command or enable-protected-configs set to yes

• R14: protected mode off with no password

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example configs, and the real report the scanner produces on the risky ones

Limits

It reads each file as written: include files, command-line options, Docker command: settings, the contents of an aclfile and firewalls are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 10 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (5 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.