Discord Context

Read Discord channel and thread message history directly via the Discord Bot API, bypassing OpenClaw's session-based message visibility. Use when you need to...

Security Scan

The skill's goal (reading Discord history via a bot token) is plausible, but the instructions explicitly tell the user to circumvent OpenClaw's protections by storing a long-lived bot token in an out-of-band file and recording its path — behavior that is disproportionate and risky and is not declared in the skill metadata.

Purpose & Capability

Reading Discord messages via the Bot API matches the skill name and description; a bot token is legitimately required. However the skill's prose explicitly recommends bypassing OpenClaw's session-based visibility and redaction by placing the token in a separate file, which is a questionable design choice that goes beyond a simple integration.

Instruction Scope

SKILL.md instructs the user to write the bot token to a file outside the workspace (~/.openclaw/.discord-bot-token) and to record that path in TOOLS.md so the agent can read it across sessions. This directs the agent/user to access persistent secrets outside OpenClaw's managed config and to perform direct network calls with the token — explicit instructions to circumvent platform-level token redaction/visibility.

Install Mechanism

Instruction-only skill with no install spec or downloaded code; nothing is written to disk by an installer. From an install mechanism perspective it's low-risk.

Credentials

The skill metadata declares no required env vars or credentials, but the runtime instructions require a privileged Discord bot token stored in a specific file. That mismatch (no declared credential but mandatory secret-in-file) is disproportionate and hides the principal secret the agent needs. The bot token grants broad read/write capabilities for any channel the bot is in and should be treated as highly sensitive.

Persistence & Privilege

The skill does not request always:true and does not modify other skills, which is good. However it instructs persistent storage of a long-lived credential in the user's home and to reference that path in TOOLS.md, which increases long-term exposure and broadens the skill's effective privilege over time.

What to consider before installing

This skill tells you how to make direct Discord API calls, but it explicitly recommends storing a long-lived bot token in a file outside OpenClaw to bypass the platform's redaction — that is risky. Before installing or using it: 1) Prefer using OpenClaw's built-in integrations or the platform's secure secret storage rather than writing tokens to disk. 2) If you must use a token file, avoid recording its path in shared repo files (e.g., TOOLS.md), keep file permissions strict (chmod 600), and use a bot with minimal permissions and frequent rotation. 3) Understand that any skill or process that can read that file can access your bot and potentially post or read messages across channels; treat the token like a full credential. 4) Ask the skill author to declare the secret requirement in the metadata (required env/config) and to provide a design that uses platform-managed secrets or short-lived credentials. If you cannot get those changes, treat this skill as suspicious and avoid storing sensitive tokens as described.

Problem

OpenClaw is session-based: agents only see messages from conversations where they have an active session. Discord threads that the agent wasn't mentioned in or hasn't interacted with are invisible — there's no built-in tool to read arbitrary channel/thread history.

Additionally, OpenClaw redacts the Discord bot token from openclaw config get and environment variables (by design), so agents cannot make direct Discord API calls using the configured token.

Solution

Store the Discord bot token in a separate file accessible to the agent, then use curl to call the Discord API directly.

Setup (one-time, run as the user)

# Store your bot token in a file outside the workspace (won't be git-committed)
echo 'YOUR_DISCORD_BOT_TOKEN' > ~/.openclaw/.discord-bot-token
chmod 600 ~/.openclaw/.discord-bot-token

Record the path in TOOLS.md so the agent knows where to find it across sessions.

Reading Messages

# Load token
DISCORD_TOKEN=$(cat ~/.openclaw/.discord-bot-token)

# Read recent messages from a channel or thread (threads are channels in Discord)
curl -s -H "Authorization: Bot $DISCORD_TOKEN" \
  "https://discord.com/api/v10/channels/{channel_or_thread_id}/messages?limit=50" \
  | python3 -m json.tool

# Read messages before a specific message ID (pagination)
curl -s -H "Authorization: Bot $DISCORD_TOKEN" \
  "https://discord.com/api/v10/channels/{channel_id}/messages?limit=50&before={message_id}" \
  | python3 -m json.tool

# List active threads in a guild channel
curl -s -H "Authorization: Bot $DISCORD_TOKEN" \
  "https://discord.com/api/v10/channels/{parent_channel_id}/threads/active" \
  | python3 -m json.tool

Finding Thread/Channel IDs

• Enable Developer Mode in Discord: User Settings → Advanced → Developer Mode
• Right-click any channel or thread → Copy Channel ID
• Thread IDs and channel IDs work the same way in the API

Key Notes

• Discord returns messages newest-first by default
• Max limit is 100 per request; use before/after params to paginate
• The bot must be a member of the guild and have View Channel + Read Message History permissions
• Rate limits apply: 50 requests/second per route (respect 429 responses and Retry-After headers)

Response Fields

Each message object contains:

• content — message text
• author.username / author.global_name — who sent it
• timestamp — when
• id — message ID (for pagination or reply references)
• referenced_message — the message being replied to (if a reply)

Security Considerations

• The token file is chmod 600 and outside the git-tracked workspace
• The bot token grants read/write access to all channels the bot is in — treat it like a password
• Prefer read-only API calls; do not use this for sending messages (use OpenClaw's native routing instead)
• If the token is rotated in Discord Developer Portal, update both openclaw config and the token file