LM Studio Discord Bot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

This is a coherent Discord-to-local-LLM bot template, but it broadly processes guild messages, logs conversation content, and tells users to store a bot token in source code.

Review before installing. Run this only in servers and channels where members know messages will be processed by an LLM bot, move the Discord token to an environment variable or secret store, pin dependencies, reduce bot permissions, avoid logging message contents by default, and change the handler to require a mention, command, or allowed channel.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:28
Vulnerability Type: Unpinned npm dependencies and mutable supply-chain inputs
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install discord.js axios

Technical Analysis

The installation instructions do not specify reviewed package versions and the project does not provide a lockfile. Consequently, each installation resolves the versions currently published under the discord.js and axios package names.

This makes the code executed by the project dependent on mutable registry state rather than a reproducible, audited dependency set. If a future package release or transitive dependency is compromised, malicious installation lifecycle scripts could execute during npm install, or malicious runtime logic could execute when the bot imports and uses the affected package.

No evidence indicates that the named packages are currently malicious. The vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

1. An attacker compromises a direct or transitive npm dependency, its maintainer account, or its release process.
2. The attacker publishes a malicious version under a package name resolved by the documented command.
3. A user follows the setup instructions and runs npm install discord.js axios.
4. npm selects the affected version because no exact versions or lockfile constrain resolution.
5. Malicious code executes through an installation lifecycle script or when the dependency is imported at runtime.

Impact Assessment

Dependency installation scripts execute with the privileges of the user running npm. A successful supply-chain compromise could therefore read or modify files accessible to that user, access environment variables and bot credentials, make network requests, or alter the generated bot project. Runtime dependency compromise would have access to bot messages, the Discord client ...[truncated 39 chars]

Remediation

View remediation

Remediation Suggestions

• Specify reviewed, exact dependency versions instead of resolving mutable latest releases.
• Generate and distribute a committed package-lock.json.
• Instruct users to install with npm ci so dependency resolution matches the lockfile.
• Review lockfile changes and package integrity metadata before accepting upgrades.
• Run npm audit and an appropriate software-composition analysis tool in continuous integration.
• Consider disabling lifecycle scripts during installation with npm ci --ignore-scripts when dependency functionality permits it.
• Perform dependency installation and bot execution under a dedicated, least-privileged operating-system account.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bot-template.js:5

Finding

Discord Bot Token Is Intended to Be Stored in Source Code

Content

View full analysis

Vulnerability Details

File Location: scripts/bot-template.js:5, scripts/bot-template.js:57; documented at SKILL.md:37-43
Vulnerability Type: Insecure credential storage
Risk Level: Medium

Vulnerable Code Snippet:

javascript

// ============ CONFIG ============
const DISCORD_TOKEN = 'YOUR_DISCORD_BOT_TOKEN_HERE';
const LM_STUDIO_URL = 'http://127.0.0.1:1234/v1/chat/completions';
const MODEL = 'qwen2-0.5b-instruct';
const GUILD_ID = 'YOUR_DISCORD_SERVER_ID_HERE';
// ============ CONFIG ============

javascript

client.login(DISCORD_TOKEN);

The corresponding documentation instructs users to edit the constant:

javascript

const DISCORD_TOKEN = 'YOUR_DISCORD_BOT_TOKEN';
const LM_STUDIO_URL = 'http://127.0.0.1:1234/v1/chat/completions';
const MODEL = 'qwen2-0.5b-instruct';  // Must match loaded model in LM Studio
const GUILD_ID = 'YOUR_DISCORD_SERVER_ID';

Technical Analysis

The distributed file contains only a placeholder and does not expose a real credential. However, the documented setup procedure directs users to replace that placeholder with a live Discord bot token in the JavaScript source.

Secrets embedded in source files are easily disclosed through version-control commits, copied project archives, source-sharing services, backups, support bundles, or overly broad filesystem permissions. Because the token is passed directly to client.login, anyone obtaining the configured source file can extract and reuse the credential without needing access to an independent secret store.

Attack Path

1. An operator replaces the placeholder with a valid Discord bot token as instructed.
2. The configured bot.js file is committed to a repository, shared for troubleshooting, included in a backup, or read by another local user.
3. An attacker extracts the plaintext token from the source.
4. The attacker uses the token to authenticate a separate Discord client ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

• Load the token from a protected environment variable or dedicated secret-management service:

  javascript

  const DISCORD_TOKEN = process.env.DISCORD_TOKEN;
  
  if (!DISCORD_TOKEN) {
    throw new Error('DISCORD_TOKEN is required');
  }
  

• Do not provide a source-code fallback containing a real secret.

• Add .env, local configuration files, and credential files to .gitignore; do not treat .env alone as a secret-management boundary.

• Document secure environment-variable injection for development and production.

• Restrict secret and service configuration access to the dedicated bot account.

• Add automated secret scanning to pre-commit hooks and continuous integration.

• Rotate the Discord token immediately if it is committed, shared, or otherwise exposed.

• Grant the bot only the minimum Discord permissions needed for its documented behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bot-template.js:28

Finding

Conversation Content Is Logged Verbatim and Raw Errors Are Disclosed to Discord

Content

View full analysis

Vulnerability Details

File Location: scripts/bot-template.js:28, scripts/bot-template.js:46, scripts/bot-template.js:49-51
Vulnerability Type: Plaintext sensitive-data logging and internal error disclosure
Risk Level: Medium

Vulnerable Code Snippet:

javascript

console.log(`[Bot] Received: "${userMessage}" from ${message.author.tag}`);

javascript

const botReply = response.data.choices[0].message.content.trim();
console.log(`[Bot] Reply: "${botReply}"`);
await message.reply(botReply);
} catch (error) {
  console.error('[Bot] Error:', error.message);
  await message.reply(`Oops: ${error.message}`);
}

Technical Analysis

Every accepted Discord prompt is written verbatim to process output together with the author's tag. Every model response is also logged verbatim. These logs may be retained by terminal history capture, process supervisors, containers, cloud logging services, or operating-system journals. Users may reasonably submit confidential information to an LLM bot without expecting the complete conversation to be persisted in operational logs.

The exception handler additionally returns error.message directly to the originating Discord channel. Axios and networking error messages can reveal operational information such as the local endpoint, connection failures, timeout behavior, or malformed upstream response details. Although the configured endpoint is documented and bound to loopback by default, raw exception disclosure unnecessarily exposes implementation details and may become more serious if configuration changes.

Attack Path

Conversation-log exposure:

1. A guild member sends confidential or personally identifiable content in a channel monitored by the bot.
2. The bot stores the complete message and author tag in process logs.
3. The local model response is also stored in the same logs.
4. A system administrator, logging-service user, compromised ...[truncated 1023 chars]

Remediation

View remediation

Remediation Suggestions

• Do not log complete prompts or model responses by default.
• Log only minimal operational metadata, such as a generated request ID, success status, latency, and sanitized error category.
• If diagnostic content logging is explicitly enabled, redact credentials and personal information, restrict log access, encrypt remote log transport and storage, and enforce short retention periods.
• Avoid recording Discord user tags unless they are necessary for a documented operational purpose.
• Return a fixed, generic Discord error such as The model service is temporarily unavailable.
• Keep sanitized diagnostics in restricted server-side logs without returning raw exception strings to users.
• Normalize known failures into predefined error codes and prevent Axios request or response details from entering user-facing messages.
• Document the bot's logging and retention policy so guild members understand how conversation data is processed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

To get your bot token: https://discord.com/developers/applications

To get the Guild ID: Enable Developer Mode in Discord → Right-click your server → Copy ID

### 4. Add bot to your server

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly routes Discord user messages to a local LM Studio inference endpoint but does not disclose this data flow or advise operators to notify users. That omission creates a privacy and consent issue because users may reasonably assume messages stay within Discord or the standard bot platform rather than being forwarded to a separately hosted local model service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bot forwards every Discord message in the configured guild directly to a local LM Studio chat completion endpoint, and users are not informed that their messages are being processed by an LLM service. Even though the endpoint is local, this still creates a privacy and transparency issue because users may disclose sensitive information without realizing it is being relayed to another system and potentially logged or retained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.