Discord Chat

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 AM UTC
• Version: 1.0.0

Overview

This Discord skill is not clearly malicious, but it exposes server-management and deletion actions that go beyond its chat-focused description and need careful review before use.

Install only if you intend the agent to perform live Discord operations and can tightly limit the bot's permissions. Use least-privilege Discord roles, avoid granting channel/category management unless needed, do not put webhook secrets in URLs, and require explicit confirmation before any edit, delete, move, or channel/category action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/CONFIG.md:96

Finding

Webhook Secret May Be Exposed Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: references/CONFIG.md, lines 96-105
Vulnerability Type: Insecure secret transmission
Risk Level: Medium

Vulnerable Code

yaml

channels:
  discord:
    plugin: discord
    token: "YOUR_BOT_TOKEN"
    webhook:
      enabled: true
      path: /webhook/discord
      secret: "random-secret-string"

The subsequent setup instruction states:

text

Include secret in webhook headers or query params

Technical Analysis

The documentation permits an inbound webhook secret to be placed in URL query parameters. Query strings are frequently recorded by reverse proxies, web servers, application access logs, monitoring platforms, analytics systems, browser histories, and intermediary infrastructure.

Consequently, a valid webhook secret may become visible to systems or personnel that do not otherwise require access to it. The example also uses the generic value random-secret-string without specifying cryptographically secure generation, minimum entropy, request signing, expiration, or replay protection.

Authentication through a dedicated header is safer than query-string authentication, but a static header secret alone does not provide message integrity or replay resistance. A robust webhook design should authenticate the request body using a keyed signature and reject stale or repeated requests.

Attack Path

1. An administrator follows the documented option and includes the webhook secret in the callback URL's query string.
2. Discord, a reverse proxy, the gateway, or an observability platform records the complete request URL.
3. An attacker or low-privilege operator with access to those logs obtains the secret.
4. The attacker sends crafted requests to /webhook/discord using the disclosed secret.
5. If the gateway treats the request as an authentic Discord event, the attacker can forge inbound events or trigger downstream message-process ...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to transmit webhook secrets through query parameters.
• Require authentication data to be sent through a dedicated authorization or signature header.
• Sign the raw request body with HMAC-SHA-256 or use the platform's official signature-verification mechanism.
• Include a timestamp and unique request identifier in the signed material.
• Reject stale timestamps and previously processed request identifiers to prevent replay attacks.
• Compare signatures using a constant-time comparison function.
• Require HTTPS and reject insecure HTTP webhook endpoints.
• Instruct administrators to generate webhook secrets with a cryptographically secure random-number generator and sufficient entropy.
• Ensure secrets and authorization headers are redacted from application, gateway, proxy, and monitoring logs.
• Document immediate secret rotation procedures for suspected exposure.

T09 · Insecure Skill Coding Practices

Note

• Location: references/CHANNELS.md:82

Finding

Permanent Discord Deletion Operations Lack a Mandatory Confirmation Workflow

Content

View full analysis

Vulnerability Details

File Location: references/CHANNELS.md, lines 82-108; related message deletion at SKILL.md, lines 62-64
Vulnerability Type: Unsafe destructive-operation handling
Risk Level: Low

Vulnerable Code

bash

## Delete Channels

**Delete a channel:**
```bash
message action=channel-delete channel=discord channelId="1234567890"

With reason (audit log):

bash

message action=channel-delete channel=discord channelId="1234567890" reason="No longer needed"

⚠️ Warning: Deletion is permanent. Cannot be undone.

Categories

Create category:

bash

message action=category-create channel=discord guildId="server-id" name="HELP DESK"

Edit category:

bash

message action=category-edit channel=discord categoryId="1234567890" name="SUPPORT"

Delete category:

bash

message action=category-delete channel=discord categoryId="1234567890"

text

The main Skill also exposes direct message deletion:

```bash
message action=delete channel=discord messageId="1234567890"

Technical Analysis

The Skill documents direct deletion of messages, channels, and categories. Although it warns that channel deletion is permanent and recommends checking before deletion, it does not establish a mandatory confirmation step, require resolution of numeric IDs to human-readable targets, or require the Agent to restate the affected guild and channel immediately before execution.

Discord identifiers are visually opaque. A mistaken, stale, hallucinated, or user-supplied identifier can therefore direct an otherwise valid administrative operation at the wrong resource. The risk is amplified when the configured bot has channel-management or message-management permissions.

This is an unsafe operational design rather than a privilege-escalation flaw: the commands operate with permissions already granted to the bot. No evidence shows that the Sk ...[truncated 1345 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation immediately before every permanent deletion.
• Before confirmation, resolve the identifier and display the exact guild, resource type, resource name, and resource ID.
• Treat vague confirmations such as “yes” as insufficient when multiple destructive operations or targets are pending.
• Require a new confirmation if the target changes after the initial preview.
• Use a two-phase workflow: first inspect and preview the target, then execute only after confirmation.
• Prefer reversible alternatives, such as archiving a channel, locking it, moving it to an archival category, or removing visibility permissions.
• Record the requesting user, resolved target, reason, confirmation, and operation result in an audit log.
• Apply least privilege to the bot. Do not grant message or channel management permissions unless the intended workflow requires them.
• Consider restricting channel and category deletion to an administrator-only policy even when ordinary chat operations are available to broader users.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file documents Discord channel administration features such as creating, editing, moving, and deleting channels, which materially exceeds the skill's declared purpose of sending, replying to, and searching messages. This capability expansion is dangerous because an agent or user relying on the skill metadata could invoke destructive server-management actions without expecting that level of authority.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented behavior includes server/channel administration, threads, permissions inspection, pin management, and category lifecycle operations, far beyond basic message send/reply/search functionality. Such scope creep increases the chance of unauthorized or unsafe actions because consumers of the skill may grant or use broader Discord permissions than intended for a chat tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Administrative operations like channel creation, deletion, category management, and permission checks are unjustified within a chat/search skill and create a path to significant integrity and availability impact on a Discord server. In this context, the mismatch makes the issue more dangerous because users would not reasonably expect a messaging skill to be able to reorganize or permanently delete server resources.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/CONFIG.md (reported line 58)May include surrounding context.

md

## Getting Guild/Channel IDs

### Enable Developer Mode

1. Discord Settings → Advanced → Enable Developer Mode
2. Now you can right-click servers/channels to copy IDs

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/CONFIG.md (reported line 60)May include surrounding context.

md

## Getting Guild/Channel IDs

### Enable Developer Mode

1. Discord Settings → Advanced → Enable Developer Mode
2. Now you can right-click servers/channels to copy IDs

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description understates the skill's actual capabilities by only mentioning sending, replying, and searching, while the body also documents read, react, edit, delete, channel listing, and channel inspection actions. This capability mismatch can mislead routing, review, or approval systems and cause the skill to be invoked in contexts where users or operators did not expect broader read/write/destructive Discord access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description is broad enough to match many generic Discord-related requests, including cases where the user may only want analysis or advice rather than live interaction with Discord. In an agentic environment, this raises the chance of over-triggering a skill with message sending, editing, deletion, and channel inspection capabilities, increasing the risk of unintended actions against real Discord resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents a delete operation with no caution, confirmation requirement, or warning that the action is destructive and potentially irreversible. In a chatops setting, this makes accidental or ambiguous deletions more likely, especially because the same skill also supports broad invocation and other message-manipulation actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation advertises a channel-list action that is outside the stated manifest scope of send/reply/search. This creates a capability mismatch that can mislead an agent or operator into attempting broader enumeration of Discord resources than intended, potentially exposing channel metadata or enabling unauthorized discovery if the backend tool actually supports it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.