Security audit

Discli

Security checks for vulnerabilities and agentic risk

Overview

This Discord management skill is mostly coherent, but it asks for high-impact Discord control while under-scoping token handling, installation safety, and persistent persona instructions.

Install only if you trust the npm package publisher and are comfortable granting a bot broad Discord authority. Use a least-privileged bot token, avoid pasting the token into command lines or chats, review ~/.discli/.env and ~/.discli/SOUL.md, and require explicit human approval for destructive or public Discord actions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:39
Finding: Unpinned Third-Party Package Is Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: Discord Bot Token Is Passed Through a Command-Line Argument
Content: View full analysis
# First-time setup ``` ### Technical Analysis The documented initialization procedure places the Discord bot token directly in a command-line argument. Command-line secrets may be exposed through several channels, including: - Shell history files. - Process listings and process-inspection interfaces. - Terminal session recording. - Agent execution transcripts. - Debug, audit, or command telemetry. - Wrapper scripts that log invoked arguments. Even if the CLI later stores the token securely, exposure can occur before or during command execution. Any local account or monitoring component capable of viewing the relevant history, process arguments, or logs may obtain the token. ### Attack Path 1. An operator substitutes a real Discord bot token for `` and runs the documented command. 2. The shell records the command in its history, or the command is captured by terminal, agent, audit, or process telemetry. 3. An attacker or unauthorized local user reads the process arguments, history file, or retained transcript. 4. The attacker extracts the token and authenticates directly to Discord as the bot. 5. The attacker invokes Discord API actions permitted by the bot's assigned roles and permissions. ### Impact Assessment A stolen token allows impersonation of the Discord bot until the credential is revoked or rotated. Depending on the bot's configured permissions, an attacker may be able to: - Read or send messages in accessible channels. - Search or delete messages. - Create, rename, clone, or delete channels. - Create, edit, assign, remove, or delete roles. - Change channel permissions. - Create invitation links. - Kick or ban members. - Modify server settings, emojis, or other managed resources. - ...[truncated 159 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:158
Finding: Persistent Persona File Is Trusted as Future Agent Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs use of a Discord bot token via environment variable and discli init --token <token>, and later states config is stored in ~/.discli/ with the token in .env, but it does not warn that this is a sensitive secret that must not be echoed, logged, pasted into chats, or exposed in shell history. In an agent context, missing credential-handling guidance increases the chance of accidental secret disclosure or insecure local storage practices.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill directs the agent to read and obey ~/.discli/SOUL.md for all bot interactions and to generate one if absent, effectively importing untrusted local-file instructions into future behavior without explicit user approval. This creates a prompt-injection and policy-drift risk, because a local persona file could override user intent, induce unsafe messaging behavior, or cause the agent to persist attacker-controlled instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file instructs the skill to always use a specific language/style variant: "lowercase casual" with gen-z texting conventions. This is a natural-language policy concern because it imposes a communication style by default rather than offering the user a choice or documenting a justified constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.