Security audit

Discord Chat 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This Discord skill mostly supports messaging, but it also documents destructive message and server-management actions beyond its stated scope.

Review before installing. Use this only with a Discord bot whose permissions are limited to the channels and actions you actually need. Require explicit confirmation before sending, editing, deleting, pinning, or changing channels/categories, and avoid broad history searches in private or sensitive channels.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented capabilities substantially exceed the declared skill scope of sending, replying to, and searching Discord messages. By exposing channel creation, deletion, editing, category management, thread management, pinning, and permission inspection, the skill enables administrative and moderation actions that can alter or destroy server state, which violates least privilege and increases the blast radius if the agent is misused, prompted incorrectly, or compromised.
Content: No source excerpt is available for this finding.

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/CONFIG.md (reported line 58)May include surrounding context.
md
## Getting Guild/Channel IDs ### Enable Developer Mode 1. Discord Settings → Advanced → Enable Developer Mode 2. Now you can right-click servers/channels to copy IDs

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/CONFIG.md (reported line 60)May include surrounding context.
md
## Getting Guild/Channel IDs ### Enable Developer Mode 1. Discord Settings → Advanced → Enable Developer Mode 2. Now you can right-click servers/channels to copy IDs

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section introduces webhook-based inbound event handling, which materially expands the skill from outbound chat/search into event ingestion. That increases attack surface through exposed webhook endpoints, secret handling, and potentially untrusted inbound Discord content, none of which is reflected in the manifest's stated scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes the skill as only supporting send/reply/search, but the body also documents read, react, edit, delete, and channel inspection operations. This scope mismatch can mislead users or orchestration systems about the skill's actual capabilities, increasing the risk of unintended destructive actions or broader data access than expected.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is broad enough to trigger on generic requests to communicate or check Discord activity, which can cause the skill to activate in ambiguous situations. In a messaging skill with externally visible and privacy-sensitive capabilities, overbroad triggering raises the chance of accidental reads, searches, or message sends without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill describes searching and reading message history without warning that these actions access potentially sensitive communications. In Discord contexts, message history may contain private, confidential, or regulated information, so normalizing these actions without privacy guidance increases the risk of over-collection and unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents edit and delete operations without warning that they are destructive and externally visible. An agent using this skill could modify or remove Discord content without clear user awareness or confirmation, creating integrity, audit, and trust issues in shared channels.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says this skill is for sending messages, replying to messages, and searching message history in Discord channels. This file instructs users to use message action=channel-list, which expands the skill’s described behavior into channel enumeration/checking capabilities not reflected in the manifest’s core operation list.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill manifest frames the skill as a Discord communication interface, but this file instructs operators to patch gateway configuration with a new Discord token. Administrative reconfiguration of the gateway is distinct from sending/replying/searching Discord messages and is not represented in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file documents message-search operations across channels, authors, mentions, and links, but does not include any warning that searches may reveal private, sensitive, or personal communication data. Under the markdown-file criteria for missing user warnings, documentation should disclose behaviors that could affect user privacy when the skill searches or enumerates message content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says the skill is for sending messages, replying to messages, and searching message history in Discord channels using the message tool. This reference file instructs use of message action=channel-list, which is a separate capability for enumerating channels and is not covered by the stated description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.