技能 upstash-redis-js

📦

upstash-redis-js

Name: upstash-redis-js
Author: upstash

内容修订 r1 高风险 ⚙️ 外部命令🔑 环境变量⚡ 包含脚本🌐 网络访问

Build Serverless Redis Features with Upstash

Serverless Redis work requires correct command patterns, serialization, expiration, and concurrency choices. This skill provides focused Upstash Redis guidance for implementation, migration, search, and optimization.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "upstash-redis-js" from https://skillstore.io/skills/upstash-upstash-redis-js.md and its manifest at https://skillstore.io/api/skills/upstash-upstash-redis-js/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/upstash-upstash-redis-js.md 已签名 manifest GET /api/skills/upstash-upstash-redis-js/manifest 已签名 lockfile GET /api/skills/upstash-upstash-redis-js/lockfile

测试它

正在使用“upstash-redis-js”。 Create a cache for user profiles with a one-hour lifetime.

预期结果:

A cache-aside design with namespaced keys, one-hour expiration, database fallback, and explicit invalidation after profile updates.

正在使用“upstash-redis-js”。 Reduce latency for fetching profile data for many users.

预期结果:

A pipeline strategy that batches related reads, preserves result ordering, and defines handling for partial failures.

正在使用“upstash-redis-js”。 Add product search with price and category filters.

预期结果:

An Upstash Redis Search plan covering schema fields, exact category matching, numeric price filters, pagination, and index readiness.

安全审计

高风险

v1 • 2026/8/25 打开版本化报告

Most static findings are false positives caused by JavaScript template literals, Redis pipeline exec methods, environment-based configuration, and search keyword fields. One static network finding is confirmed because the skill directs agents to provision an external database. Semantic review also found an authentication bypass placeholder and an unsafe simple lock-release example.

已扫描文件

3,810

分析行数

复核项

已忽略误报

已确认安全问题 (3)

高

patterns/session-management.md:214-216

Authentication Placeholder Accepts Every Login

The verifyCredentials helper returns a user for every email and password. Copying this example into an application would create a complete authentication bypass.

The helper unconditionally returns a user object and never checks the password. The placeholder label is clear, but the executable example remains unsafe if adopted.

中

SKILL.md:42

External Database Provisioning Lacks Confirmation

The skill tells an agent to create a temporary Upstash database when credentials are absent. It does not require explicit user approval before the external POST.

The instruction explicitly targets agents and describes a POST that creates a database. No confirmation or consent boundary appears in the instruction.

中

patterns/distributed-locks.md:38-39 patterns/distributed-locks.md:53-57

Simple Lock Release Can Delete Another Owner's Lock

The simple release function deletes a lock without verifying ownership. An expired and reacquired lock can be removed by the previous worker.

The finally block always calls redis.del through releaseLock. The same guide later provides token-checked release logic, confirming ownership validation is required.

能力复核项 (1)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

低

SKILL.md:42

Hardcoded URL

> **No credentials yet?** If you're an agent that needs scratch Redis and the user hasn't provided a

The text directs an agent to POST to an Upstash endpoint that creates a temporary database. This is a real external side effect without an explicit user-confirmation step.

风险因素

⚙️ 外部命令 (50)

🔑 环境变量 (42)

⚡ 包含脚本 (15)

advanced-features/pipeline-and-transactions.md:33 advanced-features/pipeline-and-transactions.md:42 advanced-features/scripting.md:35 migrations/from-ioredis.md:119 migrations/from-ioredis.md:130 migrations/from-redis-node.md:159 migrations/from-redis-node.md:169 patterns/leaderboard.md:121 patterns/session-management.md:152 patterns/session-management.md:204 performance/batching-operations.md:61 performance/pipeline-optimization.md:56 performance/pipeline-optimization.md:70 performance/pipeline-optimization.md:77 performance/pipeline-optimization.md:95

🌐 网络访问 (6)

SKILL.md:38 SKILL.md:42 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/upstash-upstash-redis-js/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg)](https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/upstash-upstash-redis-js?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/upstash-upstash-redis-js/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/upstash-upstash-redis-js.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

upstash. (2026). upstash-redis-js security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/upstash-upstash-redis-js/audits/1

BibTeX 引用

@techreport{upstash-upstash-upstash-redis-js-2026,
  author = {upstash},
  title = {upstash-redis-js security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/upstash-upstash-redis-js/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "upstash-redis-js security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "upstash"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/upstash-upstash-redis-js/audits/1"
identifiers:
  - type: other
    value: "skillstore:upstash-upstash-redis-js:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Add Application Caching

Design cache keys, expiration rules, serialization, and invalidation for a TypeScript service.

Optimize Redis Traffic

Choose batching, pipelines, transactions, retries, and timeouts for serverless workloads.

Plan a Redis Migration

Translate node-redis or ioredis usage into Upstash Redis patterns and identify behavior changes.

试试这些提示

Create a Redis Client

Show how to configure Upstash Redis in my [framework] project using environment variables and TypeScript.

Implement a Cache

Design a cache-aside flow for [data type] with key naming, TTL, invalidation, and error handling.

Migrate a Redis Module

Convert my [node-redis or ioredis] module to Upstash Redis and explain serialization, pipelines, and connection changes.

Design Atomic Redis Logic

Design an atomic [workflow] using transactions or Lua, with concurrency assumptions, failure cases, and production safeguards.

最佳实践

Keep Redis credentials in environment variables and never place tokens in source code.
Namespace keys and apply expiration rules that match each data lifecycle.
Use token-checked locks and production libraries for concurrency-sensitive workflows.

避免

Do not treat all Redis values as strings when native serialization is available.
Do not use unbounded keys or sessions without expiration and cleanup rules.
Do not provision external resources or execute destructive commands without explicit user confirmation.