Skills upstash-redis-js

📦

upstash-redis-js

Name: upstash-redis-js
Author: upstash

Content revision r1 High Risk ⚙️ External commands🔑 Env variables⚡ Contains scripts🌐 Network access

Build Serverless Redis Features with Upstash

Serverless Redis work requires correct command patterns, serialization, expiration, and concurrency choices. This skill provides focused Upstash Redis guidance for implementation, migration, search, and optimization.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Maintain this Skill? Claim it ⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "upstash-redis-js" from https://skillstore.io/skills/upstash-upstash-redis-js.md and its manifest at https://skillstore.io/api/skills/upstash-upstash-redis-js/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/upstash-upstash-redis-js.md Signed manifest GET /api/skills/upstash-upstash-redis-js/manifest Signed lockfile GET /api/skills/upstash-upstash-redis-js/lockfile

Test it

Using "upstash-redis-js". Create a cache for user profiles with a one-hour lifetime.

Expected outcome:

A cache-aside design with namespaced keys, one-hour expiration, database fallback, and explicit invalidation after profile updates.

Using "upstash-redis-js". Reduce latency for fetching profile data for many users.

Expected outcome:

A pipeline strategy that batches related reads, preserves result ordering, and defines handling for partial failures.

Using "upstash-redis-js". Add product search with price and category filters.

Expected outcome:

An Upstash Redis Search plan covering schema fields, exact category matching, numeric price filters, pagination, and index readiness.

Security Audit

High Risk

v1 • 8/25/2026 Open versioned report

Most static findings are false positives caused by JavaScript template literals, Redis pipeline exec methods, environment-based configuration, and search keyword fields. One static network finding is confirmed because the skill directs agents to provision an external database. Semantic review also found an authentication bypass placeholder and an unsafe simple lock-release example.

Files scanned

3,810

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

patterns/session-management.md:214-216

Authentication Placeholder Accepts Every Login

The verifyCredentials helper returns a user for every email and password. Copying this example into an application would create a complete authentication bypass.

The helper unconditionally returns a user object and never checks the password. The placeholder label is clear, but the executable example remains unsafe if adopted.

Medium

SKILL.md:42

External Database Provisioning Lacks Confirmation

The skill tells an agent to create a temporary Upstash database when credentials are absent. It does not require explicit user approval before the external POST.

The instruction explicitly targets agents and describes a POST that creates a database. No confirmation or consent boundary appears in the instruction.

Medium

patterns/distributed-locks.md:38-39 patterns/distributed-locks.md:53-57

Simple Lock Release Can Delete Another Owner's Lock

The simple release function deletes a lock without verifying ownership. An expired and reacquired lock can be removed by the previous worker.

The finally block always calls redis.del through releaseLock. The same guide later provides token-checked release logic, confirming ownership validation is required.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

SKILL.md:42

Hardcoded URL

> **No credentials yet?** If you're an agent that needs scratch Redis and the user hasn't provided a

The text directs an agent to POST to an Upstash endpoint that creates a temporary database. This is a real external side effect without an explicit user-confirmation step.

Risk Factors

⚙️ External commands (50)

🔑 Env variables (42)

⚡ Contains scripts (15)

advanced-features/pipeline-and-transactions.md:33 advanced-features/pipeline-and-transactions.md:42 advanced-features/scripting.md:35 migrations/from-ioredis.md:119 migrations/from-ioredis.md:130 migrations/from-redis-node.md:159 migrations/from-redis-node.md:169 patterns/leaderboard.md:121 patterns/session-management.md:152 patterns/session-management.md:204 performance/batching-operations.md:61 performance/pipeline-optimization.md:56 performance/pipeline-optimization.md:70 performance/pipeline-optimization.md:77 performance/pipeline-optimization.md:95

🌐 Network access (6)

SKILL.md:38 SKILL.md:42 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/upstash-upstash-redis-js/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg)](https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/upstash-upstash-redis-js.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

upstash. (2026). upstash-redis-js security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/upstash-upstash-redis-js/audits/1

BibTeX citation

@techreport{upstash-upstash-upstash-redis-js-2026,
  author = {upstash},
  title = {upstash-redis-js security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/upstash-upstash-redis-js/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "upstash-redis-js security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "upstash"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/upstash-upstash-redis-js/audits/1"
identifiers:
  - type: other
    value: "skillstore:upstash-upstash-redis-js:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Add Application Caching

Design cache keys, expiration rules, serialization, and invalidation for a TypeScript service.

Optimize Redis Traffic

Choose batching, pipelines, transactions, retries, and timeouts for serverless workloads.

Plan a Redis Migration

Translate node-redis or ioredis usage into Upstash Redis patterns and identify behavior changes.

Try These Prompts

Create a Redis Client

Show how to configure Upstash Redis in my [framework] project using environment variables and TypeScript.

Implement a Cache

Design a cache-aside flow for [data type] with key naming, TTL, invalidation, and error handling.

Migrate a Redis Module

Convert my [node-redis or ioredis] module to Upstash Redis and explain serialization, pipelines, and connection changes.

Design Atomic Redis Logic

Design an atomic [workflow] using transactions or Lua, with concurrency assumptions, failure cases, and production safeguards.

Best Practices

Keep Redis credentials in environment variables and never place tokens in source code.
Namespace keys and apply expiration rules that match each data lifecycle.
Use token-checked locks and production libraries for concurrency-sensitive workflows.

Avoid

Do not treat all Redis values as strings when native serialization is available.
Do not use unbounded keys or sessions without expiration and cleanup rules.
Do not provision external resources or execute destructive commands without explicit user confirmation.