Security audit

Discord History Reader

Security checks for vulnerabilities and agentic risk

Overview

This skill openly asks the agent to use a raw Discord bot token to read Discord history outside normal OpenClaw visibility, which creates a serious credential and privacy review concern.

Do not install this unless you fully intend the agent to have direct, reusable access to your Discord bot token and to read Discord channels or threads outside normal OpenClaw session visibility. A safer design would keep the token inside a brokered, read-only tool with channel allowlists, per-request approval, audit logging, and no raw credential exposure to the agent.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:12
Finding: Discord Credential Isolation Bypass Exposes an Overprivileged Bot Token
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:12-37
Vulnerability Type: Credential isolation bypass and excessive privilege exposure
Risk Level: High

Vulnerable Code Snippet:

markdown
Additionally, OpenClaw redacts the Discord bot token from `openclaw config get` and environment variables (by design), so agents cannot make direct Discord API calls using the configured token. ## Solution Store the Discord bot token in a separate file accessible to the agent, then use `curl` to call the Discord API directly. ### Setup (one-time, run as the user) ```bash # Store your bot token in a file outside the workspace (won't be git-committed) echo 'YOUR_DISCORD_BOT_TOKEN' > ~/.openclaw/.discord-bot-token chmod 600 ~/.openclaw/.discord-bot-token

Record the path in TOOLS.md so the agent knows where to find it across sessions.

Reading Messages

bash
# Load token DISCORD_TOKEN=$(cat ~/.openclaw/.discord-bot-token) # Read recent messages from a channel or thread (threads are channels in Discord) curl -s -H "Authorization: Bot $DISCORD_TOKEN" \ "https://discord.com/api/v10/channels/{channel_or_thread_id}/messages?limit=50" \ | python3 -m json.tool

text
### Technical Analysis The Skill explicitly identifies OpenClaw's token redaction as a deliberate security boundary and instructs the user to circumvent it by duplicating the raw Discord bot token into a file readable by the agent. Although `chmod 600` prevents access by other operating-system users, it does not protect the token from the agent to which it is intentionally exposed. Direct possession of the credential is broader than the declared requirement to retrieve selected channel or thread history. The token carries every Discord permission granted to the bot identity, rather than a capability limited to one channel, one request, or read-only message retrieval. The document itself acknowledges that the bot token can ...[truncated 1774 chars]
Remediation: View remediation
Remediation Suggestions

Do not make the raw Discord token readable by the agent.

Implement a trusted credential-holding tool or local proxy that performs Discord requests without returning or exposing the token.

Restrict the proxy to approved GET endpoints used for channel and thread history.

Enforce explicit guild and channel allowlists and validate all channel identifiers before issuing requests.

Require per-request user authorization for access to channels outside a predefined scope.

Use a dedicated bot identity with only View Channel and Read Message History permissions; remove message-sending, moderation, administration, and other unnecessary permissions.

Apply response-size limits, pagination limits, audit logging, and Discord rate-limit handling in the trusted tool.

Store the credential in an operating-system secret store or managed credential service available only to the trusted proxy.

Rotate the currently exposed token after migrating to the constrained design.

Add secret-redaction controls for command output, logs, errors, and diagnostic traces.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Persistent Credential-Location Disclosure Enables Cross-Session Secret Reuse
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:26
Vulnerability Type: Persistent disclosure of a sensitive credential location
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Record the path in `TOOLS.md` so the agent knows where to find it across sessions.

Technical Analysis

The Skill recommends persisting the location of the raw Discord token in general agent-facing documentation. The token itself is not written to TOOLS.md, but recording its path makes credential discovery deterministic for future sessions and removes the need for renewed user disclosure or approval.

This weakens session compartmentalization. Any later session able to read TOOLS.md and the referenced file can locate and reuse the bot credential, including sessions unrelated to Discord history retrieval. The recommendation therefore increases the credential's exposure duration and makes exploitation more reliable.

This is not classified as agent memory poisoning because the persisted value is not an attacker-controlled behavioral rule. It is an insecure credential-management practice that exposes a reusable pointer to sensitive material.

Attack Path

During setup, the user records the token-file path in TOOLS.md.

The location remains available across agent sessions.

A later session, including one influenced by malicious or injected instructions, reads TOOLS.md.

The session uses the recorded path to open the token file without asking the user to provide or authorize the credential again.

The recovered token is used to access Discord resources permitted to the bot until the token is revoked.

Impact Assessment

The practice expands access from the intended setup and usage session to any future agent session with access to TOOLS.md and the token file. It facilitates repeated unauthorized use of the Discord bot's full permission set and increases the chance of disclosure through unrela ...[truncated 230 chars]
Remediation: View remediation
Remediation Suggestions

Do not record raw secret-file paths in TOOLS.md, agent memory, workspace documentation, or other broadly readable state.

Replace filesystem paths with opaque credential handles resolved only inside a trusted credential broker.

Require explicit user approval or narrowly scoped authorization before each sensitive Discord retrieval operation.

Limit credential availability to the shortest practical lifetime and avoid exposing it across unrelated sessions.

Remove any existing token-path references from persistent agent documentation.

After removing persistent references, rotate the Discord token to invalidate copies that may already have been discovered.

Audit future sessions and tool logs for attempts to read the former token location.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The core purpose of the skill is to bypass OpenClaw's session-based visibility and disclose conversation history the agent was intentionally not allowed to see. That defeats a designed security boundary around message access and can expose private or restricted Discord content to the agent without normal participation-based authorization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly tells the agent to recover a Discord bot token from a local secret file in order to bypass the platform's intended token redaction and visibility controls. That creates a direct secret-exfiltration and privilege-bypass path, enabling the agent to act with the bot's full API permissions rather than the constrained platform model.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
DISCORD_TOKEN=$(cat ~/.openclaw/.discord-bot-token) # Read recent messages from a channel or thread (threads are channels in Discord) curl -s -H "Authorization: Bot $DISCORD_TOKEN" \ "https://discord.com/api/v10/channels/{channel_or_thread_id}/messages?limit=50" \ | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
| python3 -m json.tool # Read messages before a specific message ID (pagination) curl -s -H "Authorization: Bot $DISCORD_TOKEN" \ "https://discord.com/api/v10/channels/{channel_id}/messages?limit=50&before={message_id}" \ | python3 -m json.tool

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
| python3 -m json.tool

List active threads in a guild channel

curl -s -H "Authorization: Bot $DISCORD_TOKEN"
"https://discord.com/api/v10/channels/{parent_channel_id}/threads/active"
| python3 -m json.tool

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to activate on ordinary conversation such as 'what did they say in #channel' or 'read that thread,' which can cause the skill to run in contexts where the user did not fully understand it would bypass normal visibility boundaries. In this skill, accidental invocation is especially risky because activation may lead directly to privileged retrieval of hidden conversation history.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to load a sensitive bot token from disk and send it in authenticated API requests, but it does not require an explicit warning or consent flow at the point of use. Because the skill is designed to access otherwise hidden Discord history, the absence of a strong disclosure materially increases the risk of unauthorized credential use and privacy-invasive data access.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
bash
# Store your bot token in a file outside the workspace (won't be git-committed) echo 'YOUR_DISCORD_BOT_TOKEN' > ~/.openclaw/.discord-bot-token chmod 600 ~/.openclaw/.discord-bot-token

Record the path in TOOLS.md so the agent knows where to find it across sessions.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Although the skill presents itself as a history-reading helper, it relies on a full Discord bot token that inherently grants broader capabilities, including potential write actions on channels the bot can access. This is a privilege mismatch: the manifest implies limited read context, but the implementation hands the agent a reusable high-value credential with much wider authority.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
### Security Considerations - The token file is `chmod 600` and outside the git-tracked workspace - The bot token grants read/write access to all channels the bot is in — treat it like a password - Prefer read-only API calls; do not use this for sending messages (use OpenClaw's native routing instead) - If the token is rotated in Discord Developer Portal, update both `openclaw config` and the token file

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Reading Messages

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Ssd 3

Context-Inappropriate Capability

External Script Fetching

External Script Fetching

External Script Fetching

List active threads in a guild channel

Vague Triggers

Missing User Warnings

Sudo/Root Execution

Description-Behavior Mismatch

Sudo/Root Execution

Static analysis