Security audit

Discord Context

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it deliberately gives agents a raw Discord bot token to bypass OpenClaw message-visibility limits.

Review carefully before installing. This skill is transparent about what it does, but its design gives the agent broad Discord authority through a raw bot token. Use only a dedicated least-privileged bot restricted to the smallest set of channels, avoid write/admin permissions, rotate any token already exposed this way, and prefer a constrained read-only broker or native OpenClaw tool instead of giving agents the bearer token.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:13
Finding: Deliberate Bypass of Session Visibility and Credential Access Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:23
Finding: Persistent Plaintext Storage and Agent Discoverability of a Long-Lived Bot Credential
Content: View full analysis
~/.openclaw/.discord-bot-token chmod 600 ~/.openclaw/.discord-bot-token ``` ```markdown Record the path in `TOOLS.md` so the agent knows where to find it across sessions. ``` ### Technical Analysis The instructions store a long-lived Discord bearer token as plaintext in a predictable file and deliberately document its location in persistent Agent-facing material. File mode `0600` prevents access by other operating-system users, but it does not protect the token from: - The Agent process running as the token-owning user. - Any malicious Skill or local process executing as that user. - Prompt injection that causes the Agent to read or disclose the file. - Accidental inclusion in logs, command traces, backups, or generated output. Recording the location in `TOOLS.md` increases discoverability and ensures that the secret remains readily accessible across sessions. Keeping the file outside the Git workspace reduces accidental version-control exposure, but it does not provide meaningful isolation from the Agent that is explicitly instructed to read it. ### Attack Path 1. The user writes the Discord bot token to `~/.openclaw/.discord-bot-token`. 2. The token path is recorded in `TOOLS.md` for cross-session discovery. 3. A malicious Skill, injected Discord message, or other untrusted instruction tells the Agent to inspect its tool configuration or credential files. 4. The Agent locates the path through `TOOLS.md` or the predictable filename. 5. The Agent reads the plaintext token while running under the user account. 6. The token is used for unauthorized Discord API requests or disclosed through output, logs, memory, or another network destination. 7. Access persi ...[truncated 580 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The description explicitly frames reading messages from conversations the agent 'wasn't part of' as an intended use case. In context, this is not incidental; it is a deliberate access-control bypass that expands the agent's visibility into historical Discord conversations without normal participation-based constraints.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill tells the agent to access a separately stored bot token and use it to read Discord message history outside the agent's normal visibility boundaries. This directly defeats the platform's access model and enables collection of potentially sensitive communications from channels or threads the agent was not intended to access.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
DISCORD_TOKEN=$(cat ~/.openclaw/.discord-bot-token) # Read recent messages from a channel or thread (threads are channels in Discord) curl -s -H "Authorization: Bot $DISCORD_TOKEN" \ "https://discord.com/api/v10/channels/{channel_or_thread_id}/messages?limit=50" \ | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
| python3 -m json.tool # Read messages before a specific message ID (pagination) curl -s -H "Authorization: Bot $DISCORD_TOKEN" \ "https://discord.com/api/v10/channels/{channel_id}/messages?limit=50&before={message_id}" \ | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
| python3 -m json.tool

List active threads in a guild channel

curl -s -H "Authorization: Bot $DISCORD_TOKEN"
"https://discord.com/api/v10/channels/{parent_channel_id}/threads/active"
| python3 -m json.tool

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and conversational, increasing the chance that the skill activates in routine discussion without the user understanding that it will access out-of-session Discord history using privileged credentials. In this context, accidental invocation is more dangerous because the skill performs sensitive cross-conversation data access, not a harmless local transformation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read a bot token from a local secrets file so it can bypass the platform's intended token redaction and session visibility controls. That introduces credential access and secret-handling behavior beyond simple message retrieval, and gives the agent a reusable bearer credential with broader privileges than the immediate task requires.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The operational steps direct the agent to load a stored bot token and query Discord history directly, but they do not require an explicit user-facing consent or warning at the point of use. Because the stated purpose is to access conversations the agent normally cannot see, the absence of a clear privacy notice materially increases the risk of unauthorized data access.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
bash
# Store your bot token in a file outside the workspace (won't be git-committed) echo 'YOUR_DISCORD_BOT_TOKEN' > ~/.openclaw/.discord-bot-token chmod 600 ~/.openclaw/.discord-bot-token

Record the path in TOOLS.md so the agent knows where to find it across sessions.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Security Considerations - The token file is `chmod 600` and outside the git-tracked workspace - The bot token grants read/write access to all channels the bot is in — treat it like a password - Prefer read-only API calls; do not use this for sending messages (use OpenClaw's native routing instead) - If the token is rotated in Discord Developer Portal, update both `openclaw config` and the token file

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document acknowledges that the token grants read/write access to all channels the bot can access, while relying only on a non-enforceable instruction to 'prefer read-only' use. This is dangerous because once the agent can read the token, it can make arbitrary Discord API calls, including message sends or other state-changing operations, regardless of the documentation's stated preference.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Ssd 3

Ssd 3

External Script Fetching

External Script Fetching

External Script Fetching

List active threads in a guild channel

Vague Triggers

Context-Inappropriate Capability

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Intent-Code Divergence

Static analysis