T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:111- Finding
Persistent Storage of Attacker-Influenced Discord Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Discordbot
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Discord bot use, but it combines Discord posting/reading authority with mandatory cross-session metadata memory and an unpinned third-party CLI install.
Install only if you are comfortable giving this skill a Discord bot token and Discord posting/reading authority. Use a dedicated low-permission bot, pin and audit the agent-messenger package where possible, avoid ad-hoc latest/bunx execution for sensitive work, protect and rotate the token if exposed, and limit or disable the MEMORY.md behavior unless you want Discord IDs and names retained across sessions. Confirm before sending, deleting, uploading files, or exporting snapshots from real servers.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:6- Finding
Unpinned Third-Party Package Installation and Execution
- Content
View full analysis
/dev/null; then echo -e "${RED}Error: agent-discordbot not found${NC}" echo "Install: npm install -g agent-messenger" exit 1 fi ``` From `templates/post-message.sh`: ```bash if ! command -v agent-discordbot &> /dev/null; then echo -e "${RED}Error: agent-discordbot not found${NC}" echo "" echo "Install it with:" echo " npm install -g agent-messenger" exit 1 fi ``` From `templates/server-summary.sh`: ```bash if ! command -v agent-discordbot &> /dev/null; then echo -e "${RED}Error: agent-discordbot not found${NC}" >&2 echo "Install: npm install -g agent-messenger" >&2 exit 1 fi ``` ### Technical Analysis The Skill installs and executes the `agent-messenger` npm package without an exact version, lockfile, registry restriction, integrity hash, or signature verification. The `bunx` example can resolve and execute package content directly from the configured npm registry at invocation time. The audited project contains documentation and wrapper scripts but not the source code of the `agent-discordbot` binary. Therefore, the behavior of the most security-sensitive component—particularly credential storage and Discord API communication—is outside the reviewed artifact a ...[truncated 1783 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/monitor-channel.sh:51- Finding
Terminal Control-Sequence Injection Through Untrusted Discord Fields
- Content
View full analysis
&1) SERVER_NAME=$(echo "$SERVER_INFO" | jq -r '.name // "Unknown"') SERVER_ID=$(echo "$SERVER_INFO" | jq -r '.id // "Unknown"') ``` ```bash echo "" echo -e "${BOLD}${BLUE}Server Summary${NC}" echo -e "${BLUE}================================================${NC}" echo "" echo -e "${BOLD}Server:${NC} $SERVER_NAME" echo -e "${BOLD}ID:${NC} $SERVER_ID" echo -e "${BOLD}Bot:${NC} $BOT_NAME" ``` ```bash FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '.[0].id // "123"') FIRST_CHANNEL_NAME=$(echo "$CHANNELS" | jq -r '.[0].name // "general"') echo -e " ${GREEN}# Send message to #$FIRST_CHANNEL_NAME${NC}" echo -e " agent-discordbot message send $FIRST_CHANNEL \"Hello!\"" echo "" echo -e " ${GREEN}# List recent messages${NC}" echo -e " agent-discordbot message list $FIRST_CHANNEL --limit 10" ``` ### Technical Analysis Discord-derived values are extracted using `jq -r` and subsequently passed to `echo -e`. The `-e` option interprets backslash escapes such as `\e`, `\033`, `\n`, and `\r`. A remo ...[truncated 2334 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code is focused on generating a read-only summary of the current Discord server: it checks bot authentication, fetches server details, lists channels, lists users, and prints either JSON or a human-readable report. This is only partially aligned with the declared description's broad 'interact with Discord servers' claim, but the specific declared capabilities emphasize sending messages, reading channels, and managing reactions. In this chunk, only channel/server reading is actually performed; message sending and reaction management are not implemented, only shown as example commands in output text. Additionally, the code accesses member/user listings and server metadata, which are not explicitly represented in the declared description. Because the actual primary purpose here is server summarization and member/channel enumeration rather than the declared interaction set, this is a material description-behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Validates the token against the Discord API 2. Stores the bot with its ID and name 3. Sets this bot as the current active bot 4. Saves credentials to `~/.config/agent-messenger/discordbot-credentials.json` ## Credential Storage
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Validates the token against the Discord API 2. Stores the bot with its ID and name 3. Sets this bot as the current active bot 4. Saves credentials to `~/.config/agent-messenger/discordbot-credentials.json` ## Credential Storage
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Validates the token against the Discord API 2. Stores the bot with its ID and name 3. Sets this bot as the current active bot 4. Saves credentials to `~/.config/agent-messenger/discordbot-credentials.json` ## Credential Storage
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh echo "" FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '.[0].id // "123"') FIRST_CHANNEL_NAME=$(echo "$CHANNELS" | jq -r '.[0].name // "general"') echo -e " ${GREEN}# Send message to #$FIRST_CHANNEL_NAME${NC}" echo -e " agent-discordbot message send $FIRST_CHANNEL \"Hello!\"" echo "" echo -e " ${GREEN}# List recent messages${NC}"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Bot Token Setup
agent-discordbot uses Discord Bot tokens which you create in the Discord Developer Portal:
bash # Set bot token (validates against Discord API before saving)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs agents to persist server IDs, channel IDs, user IDs, aliases, and preferences across sessions without requiring explicit user consent or notice at time of storage. This creates a privacy and metadata retention risk, especially in multi-user or shared-agent environments where accumulated identifiers can reveal organizational structure and relationships.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The persistent-memory section normalizes cross-session retention of natural-language mappings, IDs, and preferences, which can accumulate sensitive operational context over time. Even without storing tokens, this memory can leak internal server structure, personnel identity mappings, and user habits if the file is exposed or later reused inappropriately.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill exposes actions that can modify external systems and extract potentially sensitive data, including sending/deleting messages, uploading files, and snapshotting recent messages and members, but it does not instruct the agent to seek confirmation or warn users before impactful operations. In practice, an agent could post to production servers, remove bot-authored content, or collect broad server context with insufficient user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation repeatedly shows sending messages, reading channels, and broadcasting content to Discord, which is an external third-party service, without any warning about data disclosure, consent, or safe handling of sensitive content. In an agent skill context, users may copy these patterns directly, causing internal, personal, or confidential data to be transmitted outside the local environment without realizing the privacy and compliance implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script explicitly instructs the user to set a Discord bot token on the command line (
agent-discordbot auth set your-bot-token) without warning that the token is a sensitive secret. In practice, users may paste real tokens directly into shell history, logs, screenshots, or shared terminal sessions, increasing the chance of credential disclosure and bot account compromise.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This shell script retrieves channel and user lists from the current Discord server and later prints member identifiers and names. Although it logs that it is fetching server data, it does not warn the user that potentially sensitive server membership information will be collected and output, including when redirected to a file via the documented JSON mode.
- Content
Static analysis
No suspicious patterns detected.