nixos/claude/skills/redis/SKILL.md

name, description, user-invocable, argument-hint

name	description	user-invocable	argument-hint
redis	Inspect Cleo ElastiCache (Valkey/Redis) caches through a local read-only proxy. Use when the user asks to look at, list, or check Redis/Valkey/cache keys, TTLs, sizes, or key counts for a service in dev or prod.	true	[service and question about cache contents]

redis

~/Projects/redis-proxy/redis-proxy finds the cluster, reads its AUTH token from SSM, and listens on 127.0.0.1 with no auth. TLS and AUTH happen upstream, so never handle a token or use rediss://. Only read commands are forwarded; anything else returns -ERR redis-proxy: <CMD> blocked (read-only).

~/Projects/redis-proxy/redis-proxy list --env dev|prod
~/Projects/redis-proxy/redis-proxy up <name> --env dev|prod [--port 16379] [--primary]   # run with run_in_background
valkey-cli -p 16379 <command>

Wait for listening on 127.0.0.1:<port> in the background output before connecting. Stop the proxy when done. If it reports no SSO session, ask the user to run the ! aws sso login --profile <profile> command it prints.

PII/PHI rules (org policy: never put PII/PHI into Claude)

• Prefer SCAN ... COUNT, TYPE, TTL, STRLEN, MEMORY USAGE, DBSIZE, INFO keyspace over reading values. Avoid KEYS.
• Key names can contain emails or IDs. Don't repeat a key that looks like an email in output; refer to "the key".
• In prod, don't GET/HGETALL/LRANGE etc. on keys that look like sessions, users, messages, or profiles unless the user explicitly asks, and then summarize shape (field names, sizes) rather than pasting values.
• Never read or print the SSM token.

Notes

• The proxy uses the reader endpoint by default; --primary switches. Dev can pass --allow-writes; prod refuses it.
• Default port is 16379. Pass --port to run several proxies side by side.
• Logs show blocked command names only.