T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/authentication.md:19- Finding
Automatic extraction of a full-account Discord user token
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Discord
Security checks for vulnerabilities and agentic risk
Overview
This Discord skill is disclosed as a messaging integration, but it relies on automatic full-account Discord user-token extraction, plaintext credential storage, broad account access, and inconsistent install guidance that users should review carefully.
Install only if you are comfortable giving this tool access equivalent to your Discord account, including reading private channels you can access and sending messages as you. Avoid the template instruction to install `agent-discord`; use only the documented `agent-messenger` package path after verifying provenance. Do not grant Terminal Full Disk Access for this skill unless you fully understand that other terminal-launched processes may inherit broader file access. Treat the credentials file, memory file, and saved snapshots as sensitive and remove them when no longer needed.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
references/authentication.md:98- Finding
Full-account Discord token stored in plaintext at a predictable path
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/authentication.md:212- Finding
Troubleshooting guidance requests terminal-wide Full Disk Access
- Content
View full analysis
Privacy -> Full Disk Access 3. Add your terminal application ``` ### Technical Analysis macOS Full Disk Access is granted to the terminal application and its child processes, not narrowly to the Discord data directory or this Skill. Every command, package installer, shell script, and CLI subsequently launched through that terminal may inherit access to otherwise protected user data. This permission is substantially broader than the Skill's declared messaging function. Its combination with an unpinned third-party package and Discord credential extraction significantly expands the consequences of a dependency compromise. ### Attack Path 1. Discord token extraction fails because protected files cannot be read. 2. The user follows the troubleshooting instructions and grants Full Disk Access to Terminal or iTerm. 3. The user invokes the third-party CLI or follows a package-installation instruction from that terminal. 4. The third-party process inherits broad access to protected user data. 5. A malicious or compromised dependency reads unrelated sensitive files beyond Discord's storage. ### Impact Assessment A process inheriting Full Disk Access may be able to read sensitive data belonging to unrelated applications, subject to macOS controls and the user's account privileges. Potentially exposed information includes browser data, application databases, mail data, backups, and other protected files. This permission does not directly grant root access, but it materially bypasses important privacy boundaries. ]]>- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:58- Finding
Persistent Agent memory accepts remote and user-influenced Discord metadata
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
templates/monitor-channel.sh:127- Finding
Templates recommend installing the explicitly identified wrong package
- Content
View full analysis
/dev/null; then echo -e "${RED}Error: agent-discord not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-discord" exit 1 fi ``` The primary Skill instructions contradict this recommendation: ```markdown **`agent-discord` is NOT the npm package name.** The npm package is `agent-messenger`. If the package is NOT installed, use `bunx agent-messenger discord`: ```bash bunx agent-messenger discord server list ``` **NEVER run `bunx agent-discord`** — it will fail or install a wrong package since `agent-discord` is not the npm package name. ``` ### Technical Analysis All three executable templates tell the user to globally install `agent-discord`. The Skill explicitly states that `agent-discord` is not the correct package name and may resolve to the wrong package. This creates a direct dependency-confusion or typosquatting hazard. A global package installation may execute package lifecycle scripts and exposes the resulting binary to later commands. No exact version or integrity value is specified, so even the intended `agent-messenger` dependency is not reproducibly pinned. ### Attack Path 1. A user runs one of the templates without the CLI installed. 2. The template prints `bun install -g agent-discord`. 3. The user follows the displayed instruction. 4. The package manager resolves a package other than the intended `agent-messenger`. 5. Installation hooks or the installed binary execute under the user's account. 6. The package can target Discord credentials, Agent state, and any additional filesystem access granted to the t ...[truncated 467 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/server-summary.sh:164- Finding
Comprehensive Discord snapshots are saved without restrictive permissions or explicit consent
- Content
View full analysis
&2 SNAPSHOT=$(agent-discord snapshot 2>&1) if echo "$SNAPSHOT" | jq -e '.error' > /dev/null 2>&1; then echo -e "${RED}Failed to get snapshot${NC}" >&2 ERROR_MSG=$(echo "$SNAPSHOT" | jq -r '.error // "Unknown error"') echo -e "${RED}Error: $ERROR_MSG${NC}" >&2 exit 1 fi ``` The complete snapshot is later persisted: ```bash SNAPSHOT_FILE="server-snapshot-$(date +%Y%m%d-%H%M%S).json" echo "$SNAPSHOT" > "$SNAPSHOT_FILE" echo -e "${GREEN}Full snapshot saved to: $SNAPSHOT_FILE${NC}" ``` The script extracts members and recent messages from that snapshot: ```bash MEMBERS=$(echo "$SNAPSHOT" | jq '.members // []') MEMBER_COUNT=$(echo "$MEMBERS" | jq 'length') MESSAGES=$(echo "$SNAPSHOT" | jq '.recent_messages // []') MESSAGE_COUNT=$(echo "$MESSAGES" | jq 'length') ``` ### Technical Analysis The script always writes the complete server snapshot to the current working directory, including server metadata, channels, member identities, and recent message content. It does not request explicit permission to retain the data, set a restrictive file mode, redact sensitive fields, select a protected output directory, or define a retention period. The resulting permissions depend on the user's current `umask`. Running the script from a shared directory, repository, build workspace, or synchronized folder can expose the snapshot to unintended parties or cause it to be committed or uploaded as an artifact. ### Attack Path 1. The user runs `server-summary.sh`. 2. The script requests a broad Discord server snapshot. 3. The response includes member records and recent message content. 4. The script writes the complete JSON respo ...[truncated 674 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (33)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description is broadly about Discord interaction, including sending messages, reading channels, and managing reactions. The supplied code specifically implements a channel-monitoring utility: it repeatedly calls
agent-discord message liston one channel, tracks the most recent message ID, and prints newly detected messages. That means the actual primary behavior is continuous monitoring/read access to channel messages, which is more specific than the declared description and introduces a persistent polling/monitoring behavior not clearly stated. Additionally, the declared capabilities to send messages and manage reactions are not actually exercised by this code; sending is only shown in commented example code and reactions are absent entirely. This is therefore a description/behavior mismatch, mainly because the code's concrete purpose is active monitoring rather than general Discord interaction.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description suggests an interactive Discord skill focused on operational actions like sending messages, reading channels, and managing reactions. The supplied code instead is a reporting/export utility: it validates auth/server context, calls
agent-discord snapshot, parses the returned data, displays a server summary, and persists the full snapshot locally. While it does read Discord server data, its primary purpose is server summarization and local export, not interactive server management. It also does not implement reaction management or actual message sending—those appear only as printed example commands. This is a material description/behavior mismatch.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly documents local storage of a Discord user token in a credentials file, which represents direct access to account credentials. Even with 0600 permissions, local plaintext token storage substantially increases compromise impact from local malware, shared environments, backups, or accidental disclosure.
- Content
Configuration
Credentials stored in:
~/.config/agent-messenger/discord-credentials.jsonFormat:
json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The documented use of macOS Keychain access to decrypt Discord's stored token indicates the skill is designed to retrieve protected credentials from local application storage. This is powerful credential-access behavior that can enable full Discord account takeover or impersonation if mishandled, especially because it is framed as a normal troubleshooting/auth step.
- Content
md Common causes: - Discord desktop app is not installed or not logged in - macOS Keychain access was denied (re-run and approve the prompt) - Discord is not running and LevelDB files are stale ### `agent-discord: command not found`
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide explicitly instructs users to extract a Discord user token from the desktop application's local session storage and enumerate all joined servers, which goes beyond ordinary documented use of a messaging integration and normal OAuth-style authentication. This creates a credential-harvesting workflow for a highly privileged user token and broad account metadata, increasing the chance of account compromise, misuse, and unauthorized automation.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Reading Discord's LevelDB session storage to recover a user token is direct credential access from another application's private state. That token provides the same privileges as the user account, so compromise of the extracted token enables impersonation, data access across servers and channels, and persistence until the token is revoked.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This finding reflects explicit extraction and storage of account credentials in a local file after harvesting a Discord user token. Because the token grants full account access, any disclosure or theft of the file enables account impersonation and broad access to Discord content available to the user.
- Content
md 4. Extracts user token 5. Validates token against Discord API before saving 6. Discovers ALL joined servers 7. Stores credentials securely in `~/.config/agent-messenger/discord-credentials.json` ### Platform-Specific Paths
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Documenting the exact path of a file containing a plaintext full-access token confirms a persistent credential target on disk. This increases operational risk because malware, local attackers, backup systems, or accidental user disclosure can retrieve a predictable, high-value secret.
- Content
Credentials are stored in:
text ~/.config/agent-messenger/discord-credentials.jsonFormat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The best-practices section acknowledges the presence of
credentials.json, reinforcing that the product's normal workflow depends on a sensitive credential artifact. A process built around maintaining and periodically refreshing a full-account token expands the window for theft and misuse.- Content
md ### Best Practices 1. **Protect credentials.json**: Never commit to version control 2. **Use server switching**: Keep different contexts separate 3. **Re-extract periodically**: Keep tokens fresh 4. **Revoke if compromised**: Change your Discord password to invalidate tokens
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The manual token management instructions tell users to place a Discord token directly into a local JSON file. This normalizes insecure handling of a powerful secret and creates high likelihood of leakage through shell history, copied commands, editor backups, screenshots, or source control mistakes.
- Content
md mkdir -p ~/.config/agent-messenger # Create credentials file cat > ~/.config/agent-messenger/discord-credentials.json << 'EOF' { "token": "YOUR_TOKEN_HERE", "current_server": "1234567890123456789",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Although
chmod 600itself is protective, in this context it is part of a workflow that persists a full-access Discord token to disk. Restrictive permissions mitigate but do not eliminate the core risk of storing a plaintext account credential in a local file.- Content
EOF
Set secure permissions
chmod 600 ~/.config/agent-messenger/discord-credentials.json
text If the user already has a token value, they can populate the file above. Otherwise, always prefer `agent-discord auth extract` to obtain the token automatically from the desktop app.
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh echo -e "${BOLD}${CYAN}Quick Actions:${NC}" echo "" echo -e " ${GREEN}# Send message to a channel${NC}" FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '[.[] | select(.type == 0)][0].id // "CHANNEL_ID"') FIRST_CHANNEL_NAME=$(echo "$CHANNELS" | jq -r '[.[] | select(.type == 0)][0].name // "general"') echo -e " agent-discord message send $FIRST_CHANNEL \"Hello!\""
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest and description fail to prominently disclose that the skill extracts Discord credentials from the local desktop app and stores user tokens locally. That omission can mislead users and upstream agents into authorizing a skill with much more sensitive access than its summary suggests, increasing the chance of unauthorized account access and privacy harm.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## Authentication Credentials are extracted automatically from the Discord desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background. On macOS, the system may prompt for your Keychain password the first time (required to decrypt Discord's stored token). This is a one-time prompt.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Silent background authentication and automatic extraction of Discord tokens from the desktop app are highly sensitive behaviors, especially when paired with OS keychain access. Without an explicit warning and consent flow, the skill can access private account credentials in a way users may not reasonably expect, enabling full account misuse if the token is exposed or abused.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Cross-session memory persistence increases the blast radius of any sensitive metadata the agent learns during Discord use. Because the file is meant to be read at the start of every task and overwritten over time, it creates a durable local knowledge base of servers, channels, users, and preferences that may be exposed outside the original task context.
- Content
md ## Memory The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file. ### Reading Memory
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs agents to persist server IDs, channel IDs, user IDs, and preferences across sessions without a strong warning that this metadata may be sensitive. Even if tokens are excluded, persistent retention of communication structure and user associations can expose private organizational information or social graphs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Persisting identifiers, aliases, preferences, and channel structure across sessions creates durable tracking of users and organizations beyond the immediate task. If the memory file is later accessed by another agent, user, or process, it can reveal sensitive operational context and relationship mapping.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest understates the breadth of account and metadata access, while the documented commands expose member lists, DMs, friends, mentions, notes, profiles, files, and server snapshots. Users or orchestrators relying on the short description may grant this skill broader surveillance and data-access capabilities than intended.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide presents token extraction and server discovery as the simplest authentication path without an upfront warning that it accesses private session storage and yields full-account credentials. Users may proceed without understanding the security, privacy, and policy implications, which undermines informed consent for a sensitive operation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation states that a plaintext Discord user token is stored locally and that it grants full account access. Plaintext storage of a high-value credential materially increases exposure to local compromise, accidental disclosure, backup leakage, malware theft, or unsafe debugging and support workflows.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The guide explicitly states that tokens are stored in plaintext and grant full access to the Discord account, which creates persistent session material on disk. Persistent high-privilege sessions increase exposure to local theft, long-lived compromise, and delayed detection compared with ephemeral or scoped tokens.
- Content
md ### Security - File permissions: `0600` (owner read/write only) - Tokens are stored in plaintext (same as Discord desktop app) - Keep this file secure - it grants full access to your Discord account
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The debug-mode guidance encourages detailed troubleshooting output around token extraction and validation but does not warn that logs may expose tokens, account identifiers, server metadata, or filesystem locations. Sensitive debugging output is a common source of credential leakage in terminals, CI logs, screen sharing, and support tickets.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented capability set includes file transfer, user information access, and member-list visibility beyond the narrow manifest description of sending messages, reading channels, and managing reactions. That discrepancy matters because it signals a broader access envelope than users may expect, increasing privacy and misuse risk if the skill is trusted based on the manifest alone.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
EOF
Set secure permissions
chmod 600 ~/.config/agent-messenger/discord-credentials.json
text If the user already has a token value, they can populate the file above. Otherwise, always prefer `agent-discord auth extract` to obtain the token automatically from the desktop app.