Pub Discord

• Risk level: Low
• Analyzed: Mar 12, 2026, 6:22 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill is internally inconsistent: it claims to 'control Discord' but the runtime instructions only describe calling a third‑party model API (heybossai) and require only a SKILLBOSS_API_KEY — there is no Discord authentication or Discord API usage shown.

This skill appears to be a wrapper for a third‑party API (heybossai) rather than a true Discord controller. Before installing: 1) Ask the author how Discord authentication is handled — expect to see DISCORD_BOT_TOKEN or explicit webhook usage if the skill really controls Discord. 2) Confirm what data will be sent to https://api.heybossai.com and read that service's privacy/security docs. 3) Use a limited or throwaway SKILLBOSS_API_KEY (least privilege) for testing in an isolated environment. 4) If you need real Discord control, prefer a skill that documents Discord API calls and requires Discord credentials explicitly. 5) If you proceed, monitor outbound network calls and API key usage and do not supply high‑privilege credentials until you verify behavior. If you want, I can draft specific questions to ask the author or suggest safe test requests to validate what the skill actually does.