discord-cli

• Risk level: Low
• Analyzed: Mar 10, 2026, 5:18 PM
• Findings: 0
• Version: 0.2.3

Overview

The skill largely does what it claims (local-first Discord CLI with optional AI analysis), but it reads local browser/Discord session files to extract user tokens and will transmit chat content to Anthropic when you use AI commands — and the registry metadata omits those sensitive requirements, so review before installing.

This skill is functionally coherent but handles highly sensitive data. Before installing or using it: 1) Understand it will scan local browser/Discord leveldb/profile paths to extract a Discord user token (not a bot token); only run this on machines/accounts you control. 2) AI features send message contents to Anthropic if you set ANTHROPIC_API_KEY — treat that as data exfiltration of chat content to a third party. 3) The registry metadata omitted these sensitive behaviors (env vars and filesystem access), so inspect the code yourself or run in an isolated environment if you proceed. 4) Prefer using a dedicated bot token or limited account where possible, and avoid saving tokens in shared locations; monitor network traffic or set up a proxy if you want to audit what gets sent when using analyze/summary. 5) If you need help reviewing specific files (e.g., db.py or omitted files) I can inspect them for any hidden endpoints or unexpected network calls.