Discord Hub My

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:47 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a Discord API guide, but it also ships under-documented shell scripts that load a local .env as executable shell code and send messages to a configured webhook URL.

Review before installing or running. Treat the documentation as a general Discord API guide, but do not run the included shell scripts unless you trust the skill directory contents and the .env file, verify WEBHOOK_URL points to the intended Discord webhook, and avoid sending secrets or private data as message text.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: run.sh:6

Finding

Arbitrary Shell Code Execution Through Dot-Sourced Environment File

Content

View full analysis

Vulnerability Details

File Location: run.sh:6-10
Vulnerability Type: Executable configuration file / shell command execution
Risk Level: High

sh

# 读取 .env
if [ -f "$DIR/.env" ]; then
  set -a
  . "$DIR/.env"
  set +a
fi

Technical Analysis

The script loads .env with the Bash dot command (. "$DIR/.env"). Dot-sourcing executes the file as shell code rather than parsing it strictly as key-value configuration. Consequently, shell commands, command substitutions, redirections, functions, and other executable syntax placed in .env run with the privileges of the user or Agent invoking run.sh.

The quoted path prevents path-splitting issues but does not prevent execution of malicious content within the file.

Attack Path

1. An attacker gains the ability to create or modify .env in the project directory, such as through an untrusted archive, shared workspace, compromised repository artifact, or another local write primitive.
2. The attacker adds shell syntax to .env, for example a command substitution or standalone command alongside an apparently legitimate WEBHOOK_URL assignment.
3. A user or Agent invokes run.sh.
4. Bash dot-sources .env and executes the attacker-controlled shell instructions before discord_send.sh is called.
5. The injected commands run with all filesystem, network, and process privileges available to the invoking account.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's security context. The attacker could read or modify accessible files, access environment secrets, initiate network connections, or alter project data. This code does not itself elevate privileges, so the scope is limited to permissions already held by the invoking account.

Remediation

View remediation

Remediation Suggestions

Do not execute .env as shell code. Replace dot-sourcing with a strict configuration parser that:

1. Permits only an explicit allowlist of keys, such as WEBHOOK_URL.
2. Accepts only a well-defined KEY=VALUE grammar.
3. Rejects command substitutions, shell operators, redirections, function declarations, and unexpected keys.
4. Validates each parsed value before exporting it.
5. Requires restrictive file ownership and permissions where the threat model includes other local users.

Prefer supplying WEBHOOK_URL through a trusted process environment or a dedicated secret manager. If a configuration file is necessary, use a non-executable format and parse it with a suitable parser.

T09 · Insecure Skill Coding Practices

Warning

• Location: discord_send.sh:4

Finding

Unrestricted Webhook URL Enables Arbitrary Outbound POST Requests

Content

View full analysis

Vulnerability Details

File Location: discord_send.sh:4-13
Vulnerability Type: Unvalidated outbound request destination
Risk Level: Medium

sh

if [ -z "$WEBHOOK_URL" ]; then
  echo "WEBHOOK_URL is empty. Please export WEBHOOK_URL first."
  exit 1
fi

MSG="${1:-hello from termux 👋}"

curl -sS -H "Content-Type: application/json" \
  -d "{\"content\":\"$MSG\"}" \
  "$WEBHOOK_URL" >/dev/null

Technical Analysis

The script verifies only that WEBHOOK_URL is nonempty. It does not enforce HTTPS, validate that the hostname belongs to Discord, verify the expected webhook path, or reject local, private, and link-local destinations.

Although the project describes Discord workflows, a caller capable of controlling the environment variable can direct curl to an arbitrary URL. The resulting primitive is constrained to a POST request with a JSON content type and attacker-influenced body, but it may still reach services available from the execution environment that are inaccessible to the attacker directly.

Attack Path

1. An attacker controls or influences WEBHOOK_URL, directly through the process environment or by modifying the .env consumed by run.sh.
2. The attacker sets it to a non-Discord external endpoint or a reachable internal service.
3. The attacker supplies chosen message content or induces the Agent to run the script with sensitive content.
4. discord_send.sh performs an outbound POST request to the attacker-selected destination.
5. The destination receives the request body; if it is an internal service, the request may also trigger an unintended state-changing operation compatible with the fixed request shape.

Impact Assessment

The issue can expose supplied message content to an unauthorized endpoint and provides a limited server-side request forgery primitive from the host's network position. Potential reach includes internal HTTP services accessible to the executing host. The code does not return the respo ...[truncated 100 chars]

Remediation

View remediation

Remediation Suggestions

Validate the destination before invoking curl:

1. Require the https scheme.
2. Allowlist official Discord webhook hostnames and the expected webhook URL path structure.
3. Reject embedded credentials, fragments, unexpected ports, redirects to unapproved hosts, and malformed URLs.
4. Disable or tightly constrain redirects with --max-redirs 0 unless every redirect target is revalidated.
5. Resolve and reject loopback, private, link-local, and otherwise prohibited address ranges where appropriate.
6. Store the webhook URL in a trusted secret store rather than accepting it from untrusted configuration.
7. Consider using a fixed Discord API origin and passing only validated webhook identifiers if the deployment design permits it.

T09 · Insecure Skill Coding Practices

Warning

• Location: discord_send.sh:9

Finding

Unescaped Message Input Allows JSON Payload Injection

Content

View full analysis

Vulnerability Details

File Location: discord_send.sh:9-13
Vulnerability Type: Improper JSON encoding
Risk Level: Medium

sh

MSG="${1:-hello from termux 👋}"

curl -sS -H "Content-Type: application/json" \
  -d "{\"content\":\"$MSG\"}" \
  "$WEBHOOK_URL" >/dev/null

Technical Analysis

The message is inserted directly into a JSON string without JSON encoding. Shell quoting does not provide JSON escaping. Input containing double quotes, backslashes, carriage returns, line feeds, or other control characters can produce malformed JSON. Carefully structured input may also terminate the content string and add or replace JSON properties.

This is JSON data injection rather than shell command injection: because $MSG is expanded inside a quoted shell argument, shell operators introduced by the value are not reparsed as shell syntax.

Attack Path

1. An attacker controls the first argument passed to discord_send.sh or run.sh.
2. The attacker includes JSON syntax in the message, such as an escaped string terminator followed by additional object properties.
3. The shell interpolates the value into the manually assembled request body without JSON escaping.
4. The receiving endpoint parses either an attacker-altered JSON object or rejects the malformed payload.
5. If accepted, unintended payload fields or content are processed by the webhook endpoint.

Impact Assessment

Exploitation can alter the semantics of the outgoing webhook payload, create unintended content, or reliably cause message delivery failures. The impact is bounded by the fields accepted by the destination API and the authority represented by the configured webhook. There is no demonstrated local code-execution path from this interpolation alone.

Remediation

View remediation

Remediation Suggestions

Construct the request body with a real JSON serializer rather than string interpolation. For example:

sh

payload="$(
  jq -n --arg content "$MSG" \
    '{content: $content, allowed_mentions: {parse: []}}'
)"

curl --fail-with-body --silent --show-error \
  -H "Content-Type: application/json" \
  --data-binary "$payload" \
  "$WEBHOOK_URL"

Additionally:

1. Enforce Discord's message length limit before transmission.
2. Reject unsupported control characters if they are not needed.
3. Include allowed_mentions: {parse: []} to prevent user-supplied text from generating unintended mentions.
4. Check HTTP failure status rather than printing a success message after any transport-level completion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description suggests a general-purpose Discord Bot API skill supporting interactions, commands, messages, and operations through direct HTTPS requests. The actual code is much narrower: it is a Termux bash script that posts a single content field to a Discord webhook endpoint. This is materially different from a Discord Bot API implementation, because webhooks are a separate mechanism and the code does not implement bot authentication, interactions, command handling, or broader Discord operations. While sending messages is loosely related to the description, the primary purpose and access method are significantly narrower and different enough to count as a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 6)May include surrounding context.

sh

DIR="$(cd "$(dirname "$0")" && pwd)"

# 读取 .env
if [ -f "$DIR/.env" ]; then
  set -a
  . "$DIR/.env"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 7)May include surrounding context.

sh

DIR="$(cd "$(dirname "$0")" && pwd)"

# 读取 .env
if [ -f "$DIR/.env" ]; then
  set -a
  . "$DIR/.env"
  set +a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Sourcing .env with the shell executes the file as code, not just as data. If an attacker can modify .env, they can run arbitrary commands in the script's context and access any secrets loaded into the environment; in a Discord bot workflow this could expose bot tokens or abuse the bot account.

Content

Scanner excerpt · run.sh (reported line 9)May include surrounding context.

sh

# 读取 .env
if [ -f "$DIR/.env" ]; then
  set -a
  . "$DIR/.env"
  set +a
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · discord_send.sh (reported line 11)May include surrounding context.

sh

MSG="${1:-hello from termux 👋}"

curl -sS -H "Content-Type: application/json" \
  -d "{\"content\":\"$MSG\"}" \
  "$WEBHOOK_URL" >/dev/null

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script sends user-provided message content to a remote Discord webhook using curl, which is a network operation that transmits data externally. While the script reports success afterward, it does not provide a disclosure or confirmation before sending, and there is no accompanying markdown warning in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language comments such as '读取 .env', '默认消息', and '调用你之前做的发送脚本' are only in Chinese. This can violate the language/locale policy when a skill forces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sources .env directly, which may include sensitive credentials or configuration, but there is no confirmation prompt, visible log message, or explanatory comment warning the user that local environment data will be loaded. For a code file, accessing potentially sensitive environment content without disclosure matches the missing user warnings criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.