Agent Discord

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:47 AM UTC
• Version: 1.10.5

Overview

This Discord skill is disclosed as a messaging integration, but it relies on automatic full-account Discord user-token extraction, plaintext credential storage, broad account access, and inconsistent install guidance that users should review carefully.

Install only if you are comfortable giving this tool access equivalent to your Discord account, including reading private channels you can access and sending messages as you. Avoid the template instruction to install `agent-discord`; use only the documented `agent-messenger` package path after verifying provenance. Do not grant Terminal Full Disk Access for this skill unless you fully understand that other terminal-launched processes may inherit broader file access. Treat the credentials file, memory file, and saved snapshots as sensitive and remove them when no longer needed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/authentication.md:19
• Finding: Automatic extraction of a full-account Discord user token<![CDATA[ ## Vulnerability Details **File Location**: `references/authentication.md:19-27` **Additional Locations**: `SKILL.md:19-40`, `SKILL.md:137-139`, `references/authentication.md:237-246` **Vulnerability Type**: Credential extraction with excessive account-level authority **Risk Level**: High ### Vulnerable Code ```markdown This command: 1. Detects your operating system (macOS, Linux, Windows) 2. Locates the Discord desktop app data directory 3. Reads the LevelDB storage containing session data 4. Extracts user token 5. Validates token against Discord API before saving 6. Discovers ALL joined servers 7. Stores credentials securely in `~/.config/agent-messenger/discord-credentials.json` ``` The primary instructions also state: ```markdown Credentials are extracted automatically from the Discord desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background. ``` ### Technical Analysis The Skill instructs a third-party CLI to access Discord Desktop's local session storage and extract a user authentication token. This is not a narrowly scoped OAuth or bot-token authorization flow. The extracted token inherits the user's Discord permissions and can be used to act as the user. The extraction may happen automatically when an ordinary command is run. Consequently, a request such as listing channels can trigger access to protected desktop session data without a separate, explicit authorization operation. The authentication guide confirms that the resulting credentials permit the CLI to read accessible channels, send messages, upload files, manage reactions, enumerate members, and access user information. ### Attack Path 1. The Skill installs or invokes the `agent-discord` CLI supplied by the `agent-messenger` package. 2. The user runs a routine command such as `agent-discord snapshot`. 3. The CLI locates Discord Desktop's LevelDB session storage. 4. It extracts and validates the user's D ...[truncated 941 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all extraction of user tokens from Discord Desktop storage. - Replace user-token authentication with Discord's supported OAuth2 or bot-token authorization flow. - Request only the minimum scopes and server permissions necessary for each operation. - Require explicit, informed authorization before authentication occurs. - Separate read-only and write-capable authorization profiles. - Require confirmation before sending or deleting messages, uploading files, broadcasting, or accessing broad snapshots. - Clearly identify the account, server, channel, and intended operation before any side effect. - Provide immediate credential revocation and session-expiration mechanisms. - Do not use user-account automation where it may violate Discord's terms or platform security model. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/authentication.md:98
• Finding: Full-account Discord token stored in plaintext at a predictable path<![CDATA[ ## Vulnerability Details **File Location**: `references/authentication.md:98-130` **Additional Location**: `SKILL.md:395-409` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code ```markdown ### Location Credentials are stored in: ``` ~/.config/agent-messenger/discord-credentials.json ``` ### Format ```json { "token": "user_token_here", "current_server": "1234567890123456789", "servers": { "1234567890123456789": { "server_id": "1234567890123456789", "server_name": "My Server" }, "9876543210987654321": { "server_id": "9876543210987654321", "server_name": "Another Server" } } } ``` ### Security - File permissions: `0600` (owner read/write only) - Tokens are stored in plaintext (same as Discord desktop app) - Keep this file secure - it grants full access to your Discord account ``` ### Technical Analysis Although mode `0600` prevents access by other operating-system users under normal discretionary access controls, it does not encrypt or otherwise protect the credential from processes running as the same user. The fixed path also makes the token easy to locate. Any compromised package, malicious process, overprivileged Agent tool, backup process, or accidental diagnostic collection operating under the user's account can read and reuse the token. The authentication guide explicitly states that the file grants full Discord account access. ### Attack Path 1. The CLI extracts a Discord user token or the user manually places one in the configuration file. 2. The token is stored in plaintext at `~/.config/agent-messenger/discord-credentials.json`. 3. A compromised dependency or another process running as the same user reads the known file. 4. The process copies the token and authenticates to Discord. 5. The attacker performs Discord operations with the user's permissions until the token is invalidated. ### Impact Assessment Disclosure of this fil ...[truncated 303 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not persist Discord user tokens. - Use scoped, revocable OAuth2 or bot credentials instead of user-account credentials. - Store unavoidable secrets in the operating system's credential vault, such as macOS Keychain, Windows Credential Manager, or a Linux secret service. - Use short-lived tokens and refresh mechanisms where supported. - Keep secret material out of command output, debug logs, backups, crash reports, and Agent memory. - Apply restrictive permissions before creating any credential file rather than correcting permissions afterward. - Implement token rotation, explicit logout, revocation, and expiration handling. - Document how users can verify that stored credentials have been removed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/authentication.md:212
• Finding: Troubleshooting guidance requests terminal-wide Full Disk Access<![CDATA[ ## Vulnerability Details **File Location**: `references/authentication.md:212-220` **Vulnerability Type**: Excessive operating-system permission request **Risk Level**: High ### Vulnerable Code ```markdown ### "Permission denied reading Discord data" **Cause**: Insufficient file system permissions **Solution** (macOS): 1. Grant Terminal/iTerm full disk access in System Preferences 2. Security & Privacy -> Privacy -> Full Disk Access 3. Add your terminal application ``` ### Technical Analysis macOS Full Disk Access is granted to the terminal application and its child processes, not narrowly to the Discord data directory or this Skill. Every command, package installer, shell script, and CLI subsequently launched through that terminal may inherit access to otherwise protected user data. This permission is substantially broader than the Skill's declared messaging function. Its combination with an unpinned third-party package and Discord credential extraction significantly expands the consequences of a dependency compromise. ### Attack Path 1. Discord token extraction fails because protected files cannot be read. 2. The user follows the troubleshooting instructions and grants Full Disk Access to Terminal or iTerm. 3. The user invokes the third-party CLI or follows a package-installation instruction from that terminal. 4. The third-party process inherits broad access to protected user data. 5. A malicious or compromised dependency reads unrelated sensitive files beyond Discord's storage. ### Impact Assessment A process inheriting Full Disk Access may be able to read sensitive data belonging to unrelated applications, subject to macOS controls and the user's account privileges. Potentially exposed information includes browser data, application databases, mail data, backups, and other protected files. This permission does not directly grant root access, but it materially bypasses important privacy boundaries. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the recommendation to grant Full Disk Access to an entire terminal application. - Use Discord-supported OAuth2 or bot authentication so local session storage does not need to be read. - If local access is unavoidable, use a narrowly scoped, signed helper with an explicit permission prompt. - Document the precise files required and deny access to unrelated directories. - Abort safely when permission is unavailable rather than encouraging broad permission escalation. - Tell users how to revoke any permission granted during troubleshooting. - Perform a threat-model review before requesting macOS privacy permissions. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:58
• Finding: Persistent Agent memory accepts remote and user-influenced Discord metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58-96` **Vulnerability Type**: Persistent Agent-state poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown ## Memory The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file. ### Reading Memory At the **start of every task**, read `~/.config/agent-messenger/MEMORY.md` using the `Read` tool to load any previously discovered server IDs, channel IDs, user IDs, and preferences. - If the file doesn't exist yet, that's fine — proceed without it and create it when you first have useful information to store. - If the file can't be read (permissions, missing directory), proceed without memory — don't error out. ### Writing Memory After discovering useful information, update `~/.config/agent-messenger/MEMORY.md` using the `Write` tool. Write triggers include: - After discovering server IDs and names (from `server list`, `snapshot`, etc.) - After discovering useful channel IDs and names (from `channel list`, `snapshot`, etc.) - After discovering user IDs and names (from `user list`, `user me`, etc.) - After the user gives you an alias or preference ("call this the dev server", "my main channel is X") - After discovering channel structure (categories, voice channels) When writing, include the **complete file content** — the `Write` tool overwrites the entire file. ``` ### Technical Analysis The Skill requires persistent state to be read at the beginning of every task and updated with names, identifiers, aliases, and preferences obtained from Discord or user input. Server names, channel names, usernames, and similar remote metadata may be controlled by third parties. Although the instructions prohibit storing tokens and complete message content, they do not define a strict schema, trust boundary, escaping rules, prov ...[truncated 1380 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make persistent memory opt-in and obtain explicit user approval before creating or updating it. - Store data in a strict, machine-validated schema rather than free-form Markdown. - Treat Discord-derived names and user-provided aliases as untrusted data. - Record provenance, account identity, server identity, creation time, and validation time for every mapping. - Namespace state exclusively to this Skill and the authenticated Discord account. - Escape or reject instruction-like text and unexpected control characters. - Confirm the resolved server, channel, user, and operation before performing side effects. - Revalidate stored identifiers against Discord before use. - Use atomic, field-level updates instead of overwriting the complete memory file. - Define retention limits and provide a command to inspect and delete stored state. ]]>

T08 · Insecure Dependencies

Error

• Location: templates/monitor-channel.sh:127
• Finding: Templates recommend installing the explicitly identified wrong package<![CDATA[ ## Vulnerability Details **File Location**: `templates/monitor-channel.sh:127-133` **Additional Locations**: `templates/post-message.sh:109-115`, `templates/server-summary.sh:30-35`, `SKILL.md:442-454` **Vulnerability Type**: Dependency confusion or typosquatting exposure **Risk Level**: High ### Vulnerable Code ```bash # Check if agent-discord is installed if ! command -v agent-discord &> /dev/null; then echo -e "${RED}Error: agent-discord not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-discord" exit 1 fi ``` The primary Skill instructions contradict this recommendation: ```markdown **`agent-discord` is NOT the npm package name.** The npm package is `agent-messenger`. If the package is NOT installed, use `bunx agent-messenger discord`: ```bash bunx agent-messenger discord server list ``` **NEVER run `bunx agent-discord`** — it will fail or install a wrong package since `agent-discord` is not the npm package name. ``` ### Technical Analysis All three executable templates tell the user to globally install `agent-discord`. The Skill explicitly states that `agent-discord` is not the correct package name and may resolve to the wrong package. This creates a direct dependency-confusion or typosquatting hazard. A global package installation may execute package lifecycle scripts and exposes the resulting binary to later commands. No exact version or integrity value is specified, so even the intended `agent-messenger` dependency is not reproducibly pinned. ### Attack Path 1. A user runs one of the templates without the CLI installed. 2. The template prints `bun install -g agent-discord`. 3. The user follows the displayed instruction. 4. The package manager resolves a package other than the intended `agent-messenger`. 5. Installation hooks or the installed binary execute under the user's account. 6. The package can target Discord credentials, Agent state, and any additional filesystem access granted to the t ...[truncated 467 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace every `bun install -g agent-discord` instruction with the verified package name, `agent-messenger`. - Pin the package to an audited exact version rather than accepting the latest release. - Use a lockfile and integrity verification where installation is managed by the project. - Avoid global installation; prefer a project-local, isolated dependency. - Verify package ownership, provenance, signatures, and registry metadata. - Ensure the executable name is mapped to the expected package before invocation. - Make all documentation and templates consistent with the authoritative installation instructions. - Consider vendoring or reproducibly building the audited CLI if its privileges remain sensitive. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/server-summary.sh:164
• Finding: Comprehensive Discord snapshots are saved without restrictive permissions or explicit consent<![CDATA[ ## Vulnerability Details **File Location**: `templates/server-summary.sh:164-166` **Data Collection Location**: `templates/server-summary.sh:58-85` **Vulnerability Type**: Unsafe persistence of sensitive message and member data **Risk Level**: Medium ### Vulnerable Code ```bash echo -e "${YELLOW}Fetching server snapshot...${NC}" >&2 SNAPSHOT=$(agent-discord snapshot 2>&1) if echo "$SNAPSHOT" | jq -e '.error' > /dev/null 2>&1; then echo -e "${RED}Failed to get snapshot${NC}" >&2 ERROR_MSG=$(echo "$SNAPSHOT" | jq -r '.error // "Unknown error"') echo -e "${RED}Error: $ERROR_MSG${NC}" >&2 exit 1 fi ``` The complete snapshot is later persisted: ```bash SNAPSHOT_FILE="server-snapshot-$(date +%Y%m%d-%H%M%S).json" echo "$SNAPSHOT" > "$SNAPSHOT_FILE" echo -e "${GREEN}Full snapshot saved to: $SNAPSHOT_FILE${NC}" ``` The script extracts members and recent messages from that snapshot: ```bash MEMBERS=$(echo "$SNAPSHOT" | jq '.members // []') MEMBER_COUNT=$(echo "$MEMBERS" | jq 'length') MESSAGES=$(echo "$SNAPSHOT" | jq '.recent_messages // []') MESSAGE_COUNT=$(echo "$MESSAGES" | jq 'length') ``` ### Technical Analysis The script always writes the complete server snapshot to the current working directory, including server metadata, channels, member identities, and recent message content. It does not request explicit permission to retain the data, set a restrictive file mode, redact sensitive fields, select a protected output directory, or define a retention period. The resulting permissions depend on the user's current `umask`. Running the script from a shared directory, repository, build workspace, or synchronized folder can expose the snapshot to unintended parties or cause it to be committed or uploaded as an artifact. ### Attack Path 1. The user runs `server-summary.sh`. 2. The script requests a broad Discord server snapshot. 3. The response includes member records and recent message content. 4. The script writes the complete JSON respo ...[truncated 674 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not save the full snapshot by default. - Require an explicit `--output` or `--save` option and inform the user exactly what data will be retained. - Apply `umask 077` before file creation and create the output atomically with mode `0600`. - Use a user-selected protected directory rather than the current working directory. - Minimize collection to fields required for the displayed summary. - Redact message bodies, user identifiers, and other sensitive fields unless explicitly requested. - Add configurable message limits and avoid collecting unrelated channels. - Warn when the destination is inside a repository, shared directory, synchronized folder, or build workspace. - Provide retention and secure-deletion guidance. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description is broadly about Discord interaction, including sending messages, reading channels, and managing reactions. The supplied code specifically implements a channel-monitoring utility: it repeatedly calls `agent-discord message list` on one channel, tracks the most recent message ID, and prints newly detected messages. That means the actual primary behavior is continuous monitoring/read access to channel messages, which is more specific than the declared description and introduces a persistent polling/monitoring behavior not clearly stated. Additionally, the declared capabilities to send messages and manage reactions are not actually exercised by this code; sending is only shown in commented example code and reactions are absent entirely. This is therefore a description/behavior mismatch, mainly because the code's concrete purpose is active monitoring rather than general Discord interaction.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description suggests an interactive Discord skill focused on operational actions like sending messages, reading channels, and managing reactions. The supplied code instead is a reporting/export utility: it validates auth/server context, calls `agent-discord snapshot`, parses the returned data, displays a server summary, and persists the full snapshot locally. While it does read Discord server data, its primary purpose is server summarization and local export, not interactive server management. It also does not implement reaction management or actual message sending—those appear only as printed example commands. This is a material description/behavior mismatch.

Credential Access

High

• Category: Privilege Escalation

Content

## Configuration

Credentials stored in: `~/.config/agent-messenger/discord-credentials.json`

Format:
```json

• Confidence: 95% confidence
• Finding: The skill explicitly documents local storage of a Discord user token in a credentials file, which represents direct access to account credentials. Even with 0600 permissions, local plaintext token storage substantially increases compromise impact from local malware, shared environments, backups, or accidental disclosure.

Credential Access

High

• Category: Privilege Escalation

Content

Common causes:
- Discord desktop app is not installed or not logged in
- macOS Keychain access was denied (re-run and approve the prompt)
- Discord is not running and LevelDB files are stale

### `agent-discord: command not found`

• Confidence: 93% confidence
• Finding: The documented use of macOS Keychain access to decrypt Discord's stored token indicates the skill is designed to retrieve protected credentials from local application storage. This is powerful credential-access behavior that can enable full Discord account takeover or impersonation if mishandled, especially because it is framed as a normal troubleshooting/auth step.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The guide explicitly instructs users to extract a Discord user token from the desktop application's local session storage and enumerate all joined servers, which goes beyond ordinary documented use of a messaging integration and normal OAuth-style authentication. This creates a credential-harvesting workflow for a highly privileged user token and broad account metadata, increasing the chance of account compromise, misuse, and unauthorized automation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Reading Discord's LevelDB session storage to recover a user token is direct credential access from another application's private state. That token provides the same privileges as the user account, so compromise of the extracted token enables impersonation, data access across servers and channels, and persistence until the token is revoked.

Credential Access

High

• Category: Privilege Escalation

Content

4. Extracts user token
5. Validates token against Discord API before saving
6. Discovers ALL joined servers
7. Stores credentials securely in `~/.config/agent-messenger/discord-credentials.json`

### Platform-Specific Paths

• Confidence: 98% confidence
• Finding: This finding reflects explicit extraction and storage of account credentials in a local file after harvesting a Discord user token. Because the token grants full account access, any disclosure or theft of the file enables account impersonation and broad access to Discord content available to the user.

Credential Access

High

• Category: Privilege Escalation

Content

Credentials are stored in:
```
~/.config/agent-messenger/discord-credentials.json
```

### Format

• Confidence: 94% confidence
• Finding: Documenting the exact path of a file containing a plaintext full-access token confirms a persistent credential target on disk. This increases operational risk because malware, local attackers, backup systems, or accidental user disclosure can retrieve a predictable, high-value secret.

Credential Access

High

• Category: Privilege Escalation

Content

### Best Practices

1. **Protect credentials.json**: Never commit to version control
2. **Use server switching**: Keep different contexts separate
3. **Re-extract periodically**: Keep tokens fresh
4. **Revoke if compromised**: Change your Discord password to invalidate tokens

• Confidence: 92% confidence
• Finding: The best-practices section acknowledges the presence of `credentials.json`, reinforcing that the product's normal workflow depends on a sensitive credential artifact. A process built around maintaining and periodically refreshing a full-account token expands the window for theft and misuse.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/agent-messenger

# Create credentials file
cat > ~/.config/agent-messenger/discord-credentials.json << 'EOF'
{
  "token": "YOUR_TOKEN_HERE",
  "current_server": "1234567890123456789",

• Confidence: 96% confidence
• Finding: The manual token management instructions tell users to place a Discord token directly into a local JSON file. This normalizes insecure handling of a powerful secret and creates high likelihood of leakage through shell history, copied commands, editor backups, screenshots, or source control mistakes.

Credential Access

High

• Category: Privilege Escalation

Content

EOF

# Set secure permissions
chmod 600 ~/.config/agent-messenger/discord-credentials.json
```

If the user already has a token value, they can populate the file above. Otherwise, always prefer `agent-discord auth extract` to obtain the token automatically from the desktop app.

• Confidence: 90% confidence
• Finding: Although `chmod 600` itself is protective, in this context it is part of a workflow that persists a full-access Discord token to disk. Restrictive permissions mitigate but do not eliminate the core risk of storing a plaintext account credential in a local file.

Exfiltration Commands

High

• Category: Prompt Injection

Content

echo -e "${BOLD}${CYAN}Quick Actions:${NC}"
echo ""
echo -e "  ${GREEN}# Send message to a channel${NC}"
FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '[.[] | select(.type == 0)][0].id // "CHANNEL_ID"')
FIRST_CHANNEL_NAME=$(echo "$CHANNELS" | jq -r '[.[] | select(.type == 0)][0].name // "general"')
echo -e "  agent-discord message send $FIRST_CHANNEL \"Hello!\""

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest and description fail to prominently disclose that the skill extracts Discord credentials from the local desktop app and stores user tokens locally. That omission can mislead users and upstream agents into authorizing a skill with much more sensitive access than its summary suggests, increasing the chance of unauthorized account access and privacy harm.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Authentication

Credentials are extracted automatically from the Discord desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background.

On macOS, the system may prompt for your Keychain password the first time (required to decrypt Discord's stored token). This is a one-time prompt.

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Silent background authentication and automatic extraction of Discord tokens from the desktop app are highly sensitive behaviors, especially when paired with OS keychain access. Without an explicit warning and consent flow, the skill can access private account credentials in a way users may not reasonably expect, enabling full account misuse if the token is exposed or abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Memory

The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file.

### Reading Memory

• Confidence: 90% confidence
• Finding: Cross-session memory persistence increases the blast radius of any sensitive metadata the agent learns during Discord use. Because the file is meant to be read at the start of every task and overwritten over time, it creates a durable local knowledge base of servers, channels, users, and preferences that may be exposed outside the original task context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs agents to persist server IDs, channel IDs, user IDs, and preferences across sessions without a strong warning that this metadata may be sensitive. Even if tokens are excluded, persistent retention of communication structure and user associations can expose private organizational information or social graphs.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Persisting identifiers, aliases, preferences, and channel structure across sessions creates durable tracking of users and organizations beyond the immediate task. If the memory file is later accessed by another agent, user, or process, it can reveal sensitive operational context and relationship mapping.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest understates the breadth of account and metadata access, while the documented commands expose member lists, DMs, friends, mentions, notes, profiles, files, and server snapshots. Users or orchestrators relying on the short description may grant this skill broader surveillance and data-access capabilities than intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide presents token extraction and server discovery as the simplest authentication path without an upfront warning that it accesses private session storage and yields full-account credentials. Users may proceed without understanding the security, privacy, and policy implications, which undermines informed consent for a sensitive operation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation states that a plaintext Discord user token is stored locally and that it grants full account access. Plaintext storage of a high-value credential materially increases exposure to local compromise, accidental disclosure, backup leakage, malware theft, or unsafe debugging and support workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Security

- File permissions: `0600` (owner read/write only)
- Tokens are stored in plaintext (same as Discord desktop app)
- Keep this file secure - it grants full access to your Discord account

• Confidence: 97% confidence
• Finding: The guide explicitly states that tokens are stored in plaintext and grant full access to the Discord account, which creates persistent session material on disk. Persistent high-privilege sessions increase exposure to local theft, long-lived compromise, and delayed detection compared with ephemeral or scoped tokens.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The debug-mode guidance encourages detailed troubleshooting output around token extraction and validation but does not warn that logs may expose tokens, account identifiers, server metadata, or filesystem locations. Sensitive debugging output is a common source of credential leakage in terminals, CI logs, screen sharing, and support tickets.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documented capability set includes file transfer, user information access, and member-list visibility beyond the narrow manifest description of sending messages, reading channels, and managing reactions. That discrepancy matters because it signals a broader access envelope than users may expect, increasing privacy and misuse risk if the skill is trusted based on the manifest alone.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Set secure permissions
chmod 600 ~/.config/agent-messenger/discord-credentials.json
```

If the user already has a token value, they can populate the file above. Otherwise, always prefer `agent-discord auth extract` to obtain the token automatically from the desktop app.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.