Security audit

Discord Hub Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for building a Discord hub, but it needs Review because it can make persistent server changes with a bot token while overstating permission setup and handling the token unsafely.

Install only if you are comfortable giving the script a Discord bot token with server-management permissions. Use a test or empty guild first, verify the guild ID, avoid passing the token on the command line, rotate the token if it has been exposed in shell history or logs, and manually verify channel permissions before putting sensitive agent outputs or personal content in the server.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build_hub.py:167
Finding: Discord Bot Token Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/build_hub.py:48
Finding: Dry-Run Mode Performs an Undisclosed Authenticated Network Request
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims it builds a complete Discord server including permissions, but the documented behavior admits that channel-specific permissions and access controls are not actually implemented. This mismatch can cause users to deploy channels they believe are owner-only or read-only when they are not, leading to unintended exposure or misuse of operational channels.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill explicitly performs networked actions against the Discord REST API and requires a bot token, but it declares no tool scope or allowed-tools restrictions. Missing scope declarations weaken policy enforcement and reviewability, making it easier for an agent runtime to invoke network-capable behavior without clear authorization boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code performs outbound HTTP requests authenticated with a Discord bot token and sends guild structure data to Discord's API. While the script's purpose is to build a Discord server, the file itself provides no inline warning, confirmation, or comment reminding users that credentials and server metadata will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims to set up a Discord command center with roles, permissions, and owner-only/restricted areas, but it never creates permission overwrites or assigns roles to enforce those controls. As a result, channels labeled as owner-only or read-only are created with default server permissions, which can expose sensitive agent outputs or allow unauthorized users to post in supposedly restricted channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs bulk creation of roles, categories, channels, messages, and pins immediately when run without a confirmation gate. In a high-privilege Discord administration context, a mistyped guild ID, accidental execution, or misuse by another operator can rapidly alter a production server in ways that are disruptive and difficult to clean up.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Channel metadata such as readonly_humans, owner_only_send, and topics like 'Owner only' imply access restrictions, but these flags are only descriptive and are never enforced in API calls. This creates a dangerous mismatch between operator expectations and actual Discord ACLs, increasing the chance of sensitive content being visible or writable by unintended members.
Content: No source excerpt is available for this finding.

Excessive Permissions

Low

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
Before running, confirm the user has: 1. **A Discord bot** — created at https://discord.com/developers/applications 2. **Bot permissions:** `Manage Channels`, `Manage Roles`, `Send Messages`, `Manage Messages` (for pinning) 3. **Bot invited to the server** — use OAuth2 URL with `bot` scope + above permissions 4. **Guild ID** — right-click server name → Copy Server ID (Developer Mode must be on) 5. **Bot token** — from the Bot tab in developer portal

Static analysis

No suspicious patterns detected.