T06 · System Persistence
Error
- Location
readme.md:97- Finding
Reboot-Persistent Execution Through Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Discord AI Dispatcher
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent webhook notifier guide, but it asks for persistent background execution, plaintext webhook secret storage, and automatic state-reset/replay behavior without enough user control or rollback guidance.
Install only if you are comfortable with a background notifier that can keep running after reboot, store webhook URLs locally, and automatically reset state or resend recent notifications during recovery. Use a low-privilege account, restrict file permissions, keep webhook secrets out of source control and logs, require manual approval for state resets or replay, and document how to disable and remove any scheduled task or cron entry.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
readme.md:126- Finding
Webhook Bearer Credentials Stored in Plaintext JSON Configuration
- Content
View full analysis
**Operational Note**: This skill uses an "Automatic Healing" pattern. If state files are corrupted, the system repairs them immediately to maintain uptime. This is internally consistent with its goal of a persistent headless worker, but users should be aware that recovery often includes a "Backlog Re-sync" of recent history. Webhook secrets are stored locally in the `config/` directory. ``` At `readme.md:126`: ```markdown - **Secrets Storage**: All webhook URLs and configuration secrets are stored locally in `config/webhooks.json`. No external credential managers are used. ``` ### Technical Analysis Webhook URLs generally contain tokens that operate as bearer credentials: possession of the complete URL may be sufficient to submit messages to the associated destination. The documented design stores these URLs and other configuration secrets in an ordinary local JSON file without using an operating-system secret store or external credential manager. The documentation does not specify restrictive filesystem permissions, encryption at rest, repository exclusions, backup exclusions, output redaction, or rotation controls. Consequently, secrets may be exposed through overly broad local permissions, accidental source-control commits, support bundles, backups, logs, or access by another process running as the same user. Sending alert information to a user-configured webhook is necessary for the declared notifier functionality. However, keeping the webhook credential in a conventional plaintext configuration file is not the minimum-risk method of enabling that network behavior. ### Attack Path 1. A user configures the notifier and writes a complete webhook URL to `config/webhooks.json`. 2. The file is copied into source control, included ...[truncated 957 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The documented behavior allows the system to autonomously delete and recreate state files when corruption is detected, without requiring operator approval or guaranteed validation of the corruption condition. In this dispatcher context, state controls deduplication and delivery history, so an incorrect or adversarially triggered reset can cause replay of historical events, duplicate notifications, loss of audit continuity, and recovery actions against locally stored secrets/config-dependent workflows.
- Content
md The dispatcher follows a **Local-First** security model: - **Secrets Storage**: All webhook URLs and configuration secrets are stored locally in `config/webhooks.json`. No external credential managers are used. - **Auto-Repair Notice**: The system is designed for **High Availability**. If it detects a corrupted JSON state file (due to a crash or power loss), it will **automatically delete and re-initialize** the file. - *Caveat*: This may trigger a one-time "Recovery Surge" where the system re-sends notifications from the last 24 hours to ensure no data was missed during the downtime. Review state files manually if you wish to skip historical re-syncs. ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs automatic deletion and re-initialization of corrupted state files without requiring operator confirmation, backup, or clearly warning about loss of forensic/debug data. In an automation context, this can erase evidence of failure, discard valid partial state, or trigger unintended replay/resync behavior after transient parse errors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill recommends automatically suggesting or implementing state realignment, deduplication bypass, and forced resend behavior that alters persistent state and delivery logic. In a webhook/notification pipeline, these actions can cause duplicate or replayed notifications, integrity loss in tracking state, and unintended operational side effects if triggered without safeguards or user confirmation.
- Content