Discord Server Admin

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly disclosed Discord administration helper, but it should only be used with a tightly permissioned bot because it can make real channel and role changes.

Install only if you intend to let an agent administer Discord channels and roles. Use a dedicated bot with the minimum needed permissions, avoid the --token argument, keep the token out of logs and shell history, and review every delete, role reorder, and member-role change before running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/discord-server-admin.sh:202

Finding

Discord Bot Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/discord-server-admin.sh, lines 9 and 202–204
Vulnerability Type: Insecure credential handling through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

# Line 9
discord-server-admin.sh [--token TOKEN] <command> [args]

bash

# Lines 202–204
--token)
  BOT_TOKEN="$2"
  shift 2

Technical Analysis

The script advertises and implements a --token TOKEN option for supplying the Discord bot credential. Secrets passed as command-line arguments may be recorded in shell history and exposed through process-inspection facilities while the command is running.

Although SKILL.md recommends the DISCORD_BOT_TOKEN environment variable, the executable still provides the less secure command-line option. The token is subsequently used as a Discord Bot authorization credential, so its disclosure grants access equivalent to the permissions assigned to that bot.

Attack Path

1. An administrator invokes the script using --token followed by a valid Discord bot token.
2. The complete command may be stored in shell history or temporarily exposed in the process argument list.
3. A local attacker with access to that history or permission to inspect the process arguments obtains the token.
4. The attacker submits authenticated requests to the Discord API as the compromised bot.
5. The attacker performs operations allowed by the bot's Discord permissions and role hierarchy.

This path requires local access sufficient to inspect command history or process metadata.

Impact Assessment

Token compromise allows an attacker to impersonate the bot and exercise all privileges granted to it. Within this tool's intended scope, that can include listing, creating, editing, moving, or deleting accessible channels and roles, as well as assigning or removing roles from members. If the bot has broader permissions than required, the stol ...[truncated 315 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --token option from the usage text and argument parser.
2. Accept the credential only through DISCORD_BOT_TOKEN or an operating-system-backed secret manager.
3. If interactive credential entry is necessary, read it silently from a TTY so it is not included in process arguments or shell history.
4. Document that users must not place tokens directly in command lines, scripts, logs, or checked-in configuration files.
5. Grant the Discord bot only the minimum permissions required for the intended channel and role operations.
6. Rotate any token that has previously been supplied through --token if command history or process information may have been accessible.
7. Ensure logs and error handling never print the authorization header or token value.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This command directly deletes an arbitrary channel ID supplied by the caller with no policy validation, confirmation, or allowlist checks. In an agent setting, a malicious prompt or untrusted input could cause destructive deletion of channels in any guild the bot can access, making this a real parameter-abuse risk.

Content

Scanner excerpt · scripts/discord-server-admin.sh (reported line 252)May include surrounding context.

sh

;;
  channel-delete)
    [[ $# -eq 1 ]] || err "usage: channel-delete <channel_id>"
    api DELETE "/channels/$1"
    ;;
  role-create)
    [[ $# -ge 2 ]] || err "usage: role-create <guild_id> <name> [options]"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This endpoint deletes a role based entirely on caller-supplied guild and role IDs, without guardrails around privileged or sensitive roles. Abuse could remove access-control roles, disrupt moderation, or break server permissions across any guild reachable by the bot.

Content

Scanner excerpt · scripts/discord-server-admin.sh (reported line 269)May include surrounding context.

sh

;;
  role-delete)
    [[ $# -eq 2 ]] || err "usage: role-delete <guild_id> <role_id>"
    api DELETE "/guilds/$1/roles/$2"
    ;;
  role-position)
    [[ $# -eq 3 ]] || err "usage: role-position <guild_id> <role_id> <position>"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This command removes a role from an arbitrary user using raw caller-supplied IDs and no business-rule enforcement. An attacker controlling tool inputs could strip important access roles from members, causing denial of access or privilege manipulation within accessible servers.

Content

Scanner excerpt · scripts/discord-server-admin.sh (reported line 287)May include surrounding context.

sh

;;
  member-role-remove)
    [[ $# -eq 3 ]] || err "usage: member-role-remove <guild_id> <role_id> <user_id>"
    api DELETE "/guilds/$1/members/$3/roles/$2"
    ;;
  *)
    usage

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes a shell script and depends on environment-based secrets, but it does not declare an explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent runtime may permit broader shell or environment access than the skill's narrow description implies, increasing the chance of unintended command execution or secret exposure during use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The script sends a Discord bot token in an Authorization header to an external service and performs write operations against live Discord resources. While external transmission is expected for this skill, it is still security-relevant because the tool can modify channels, roles, and member role assignments in a real server if invoked with attacker-controlled parameters.

Content

Scanner excerpt · scripts/discord-server-admin.sh (reported line 101)May include surrounding context.

sh

trap 'rm -f "$tmp"' RETURN

  if [[ -n "$data" ]]; then
    code=$(curl -sS -o "$tmp" -w '%{http_code}' -X "$method" \
      "$API_BASE$endpoint" \
      -H "Authorization: Bot $BOT_TOKEN" \
      -H 'Content-Type: application/json' \