📦

upstash-redis-js

Name: upstash-redis-js
Author: upstash

مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية🔑 متغيرات البيئة⚡ يحتوي على سكربتات🌐 الوصول إلى الشبكة

Build Serverless Redis Features with Upstash

Serverless Redis work requires correct command patterns, serialization, expiration, and concurrency choices. This skill provides focused Upstash Redis guidance for implementation, migration, search, and optimization.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "upstash-redis-js" from https://skillstore.io/skills/upstash-upstash-redis-js.md and its manifest at https://skillstore.io/api/skills/upstash-upstash-redis-js/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/upstash-upstash-redis-js.md manifest موقَّع GET /api/skills/upstash-upstash-redis-js/manifest lockfile موقَّع GET /api/skills/upstash-upstash-redis-js/lockfile

اختبرها

جارٍ استخدام "upstash-redis-js". Create a cache for user profiles with a one-hour lifetime.

النتيجة المتوقعة:

A cache-aside design with namespaced keys, one-hour expiration, database fallback, and explicit invalidation after profile updates.

جارٍ استخدام "upstash-redis-js". Reduce latency for fetching profile data for many users.

النتيجة المتوقعة:

A pipeline strategy that batches related reads, preserves result ordering, and defines handling for partial failures.

جارٍ استخدام "upstash-redis-js". Add product search with price and category filters.

النتيجة المتوقعة:

An Upstash Redis Search plan covering schema fields, exact category matching, numeric price filters, pagination, and index readiness.

التدقيق الأمني

مخاطر عالية

v1 • ٢٥‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Most static findings are false positives caused by JavaScript template literals, Redis pipeline exec methods, environment-based configuration, and search keyword fields. One static network finding is confirmed because the skill directs agents to provision an external database. Semantic review also found an authentication bypass placeholder and an unsafe simple lock-release example.

الملفات التي تم فحصها

3,810

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (3)

مرتفع

patterns/session-management.md:214-216

Authentication Placeholder Accepts Every Login

The verifyCredentials helper returns a user for every email and password. Copying this example into an application would create a complete authentication bypass.

The helper unconditionally returns a user object and never checks the password. The placeholder label is clear, but the executable example remains unsafe if adopted.

متوسط

SKILL.md:42

External Database Provisioning Lacks Confirmation

The skill tells an agent to create a temporary Upstash database when credentials are absent. It does not require explicit user approval before the external POST.

The instruction explicitly targets agents and describes a POST that creates a database. No confirmation or consent boundary appears in the instruction.

متوسط

patterns/distributed-locks.md:38-39 patterns/distributed-locks.md:53-57

Simple Lock Release Can Delete Another Owner's Lock

The simple release function deletes a lock without verifying ownership. An expired and reacquired lock can be removed by the previous worker.

The finally block always calls redis.del through releaseLock. The same guide later provides token-checked release logic, confirming ownership validation is required.

عناصر مراجعة القدرات (1)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

منخفض

SKILL.md:42

Hardcoded URL

> **No credentials yet?** If you're an agent that needs scratch Redis and the user hasn't provided a

The text directs an agent to POST to an Upstash endpoint that creates a temporary database. This is a real external side effect without an explicit user-confirmation step.

عوامل الخطر

⚙️ الأوامر الخارجية (50)

🔑 متغيرات البيئة (42)

⚡ يحتوي على سكربتات (15)

advanced-features/pipeline-and-transactions.md:33 advanced-features/pipeline-and-transactions.md:42 advanced-features/scripting.md:35 migrations/from-ioredis.md:119 migrations/from-ioredis.md:130 migrations/from-redis-node.md:159 migrations/from-redis-node.md:169 patterns/leaderboard.md:121 patterns/session-management.md:152 patterns/session-management.md:204 performance/batching-operations.md:61 performance/pipeline-optimization.md:56 performance/pipeline-optimization.md:70 performance/pipeline-optimization.md:77 performance/pipeline-optimization.md:95

🌐 الوصول إلى الشبكة (6)

SKILL.md:38 SKILL.md:42 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/upstash-upstash-redis-js/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg)](https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/upstash-upstash-redis-js.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

upstash. (2026). upstash-redis-js security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/upstash-upstash-redis-js/audits/1

اقتباس BibTeX

@techreport{upstash-upstash-upstash-redis-js-2026,
  author = {upstash},
  title = {upstash-redis-js security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/upstash-upstash-redis-js/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "upstash-redis-js security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "upstash"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/upstash-upstash-redis-js/audits/1"
identifiers:
  - type: other
    value: "skillstore:upstash-upstash-redis-js:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Add Application Caching

Design cache keys, expiration rules, serialization, and invalidation for a TypeScript service.

Optimize Redis Traffic

Choose batching, pipelines, transactions, retries, and timeouts for serverless workloads.

Plan a Redis Migration

Translate node-redis or ioredis usage into Upstash Redis patterns and identify behavior changes.

جرّب هذه الموجّهات

Create a Redis Client

Show how to configure Upstash Redis in my [framework] project using environment variables and TypeScript.

Implement a Cache

Design a cache-aside flow for [data type] with key naming, TTL, invalidation, and error handling.

Migrate a Redis Module

Convert my [node-redis or ioredis] module to Upstash Redis and explain serialization, pipelines, and connection changes.

Design Atomic Redis Logic

Design an atomic [workflow] using transactions or Lua, with concurrency assumptions, failure cases, and production safeguards.

أفضل الممارسات

Keep Redis credentials in environment variables and never place tokens in source code.
Namespace keys and apply expiration rules that match each data lifecycle.
Use token-checked locks and production libraries for concurrency-sensitive workflows.

تجنب

Do not treat all Redis values as strings when native serialization is available.
Do not use unbounded keys or sessions without expiration and cleanup rules.
Do not provision external resources or execute destructive commands without explicit user confirmation.