Discord

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:24 AM UTC
• Version: 1.0.6

Overview

This Discord skill is mostly coherent and disclosed, but it asks users to trust an unversioned external plugin and hosted OAuth broker that can perform high-impact Discord account actions.

Install only if you are comfortable granting ClawLink persistent Discord OAuth access and using its separate plugin/service as a trusted credential broker. Before connecting a production Discord account or server, check what OAuth scopes are requested, confirm how to revoke ClawLink and Discord authorization, and require explicit confirmation before any tool leaves a guild, changes profile data, edits command permissions, consumes entitlements, or deletes role-connection/entitlement data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unverifiable Third-Party Plugin Installation and Credential Delegation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–41
Vulnerability Type: Third-party supply-chain and credential-broker risk
Risk Level: Medium

text

**Step 1** — Install the ClawLink plugin:

openclaw plugins install clawhub:clawlink-plugin

text

Start a fresh chat after installing.

**Step 2** — Pair ClawLink:
1. Call `clawlink_begin_pairing`
2. Open the returned URL in your browser
3. Sign in to ClawLink and approve the device

**Step 3** — Connect Discord:
Open [claw-link.dev/dashboard?add=discord](https://claw-link.dev/dashboard?add=discord), complete the OAuth flow, then confirm.

Technical Analysis

The Skill instructs users to install and execute the externally distributed clawlink-plugin. The plugin's source, immutable version, checksum, and implementation are not included in the audited project, whose only file is SKILL.md. Consequently, the executable behavior of the dependency cannot be verified from this artifact.

The workflow also delegates Discord OAuth credential handling and API routing to the ClawLink hosted service. Although this architecture is disclosed rather than hidden, it creates a supply-chain and trust-boundary risk: the installed package or hosted service can change independently after this Skill has been reviewed. A compromised package release, distribution account, pairing endpoint, or cloud service could abuse the Discord permissions granted by the user.

The reviewed file does not contain evidence that the plugin is malicious. The issue is the unauditable executable dependency and external credential delegation without an immutable version, integrity verification, or locally reviewable implementation.

Attack Path

1. A user follows the instructions in SKILL.md and installs clawhub:clawlink-plugin.
2. The plugin executes inside OpenClaw despite its implementation not being present in the reviewed Skill.
3. The user invokes `clawlink_beg ...[truncated 1191 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific immutable version rather than installing an unversioned package.
2. Publish and verify a cryptographic checksum or signed provenance record for each approved release.
3. Make the plugin source available for review and provide reproducible builds that can be matched to the distributed artifact.
4. Verify pairing URLs against a strict HTTPS origin allowlist before presenting or opening them. Reject redirects to unapproved domains.
5. Request only the minimum Discord OAuth scopes required for the operation being performed.
6. Display the requested scopes and resulting privileges clearly before the user approves authorization.
7. Require explicit, operation-specific confirmation before every mutating or destructive Discord action.
8. Use short-lived, revocable credentials and provide clear instructions for revoking both ClawLink device access and Discord OAuth authorization.
9. Document the plugin's update policy, credential storage protections, incident-response process, and security contact.
10. Subject both the plugin and hosted credential-routing service to independent security review before they are trusted with production Discord accounts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes multiple state-changing and potentially destructive Discord operations such as leaving guilds, deleting entitlements, deleting role connections, and modifying the current user, but it does not present a clear top-level warning that these actions can materially affect the user's account or server state. In a chat-driven agent context, users may invoke tools based on natural-language suggestions without realizing some operations are irreversible or high-impact, increasing the chance of accidental misuse.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md

- Start a fresh OpenClaw chat to reload the plugin catalog
- Call `clawlink_list_integrations` to confirm ClawLink is paired

**"Permission denied" when editing command permissions:**
- Requires OAuth2 Bearer token (bot tokens will error)
- User must have both MANAGE_GUILD and MANAGE_ROLES permissions in the target guild

Static analysis

No suspicious patterns detected.