Discord OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:03 AM UTC
• Version: 1.0.1

Overview

This Discord API skill is mostly coherent, but it needs Review because it recommends broad Discord OAuth permissions through an undocumented fixed client ID.

Install only if you are comfortable using UXC with Discord credentials. Prefer a bot token you control with the minimum Discord permissions needed, and avoid the provided OAuth flow unless you verify the OAuth application owner and reduce scopes to the specific data you need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57

Finding

Overly Broad OAuth Scopes Used with a Fixed Application Identity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-72, SKILL.md:91-96, and SKILL.md:116-122
Vulnerability Type: Excessive OAuth permissions and unverified fixed client identity
Risk Level: Medium

Vulnerable Code

markdown

**Configuration:**
- Client ID: `1479302369723285736`
- Redirect URI: `http://127.0.0.1:11111/callback`

**OAuth2 Scopes:**

Discord user OAuth2 supports **read-only operations**. It cannot send messages or manage servers as a user (use Bot Token for those operations).

**Recommended Scopes (Full Functionality):**
```bash
--scope "identify email connections guilds guilds.members.read messages.read openid"

Minimal Read-Only Scopes:

bash

--scope "identify email connections guilds guilds.members.read"

text

```bash
uxc auth oauth start discord-user \
  --endpoint https://discord.com/api/oauth2/token \
  --client-id 1479302369723285736 \
  --redirect-uri http://127.0.0.1:11111/callback \
  --scope "identify email connections guilds guilds.members.read messages.read openid"

bash

uxc auth oauth login discord-user \
  --endpoint https://discord.com/api/oauth2/token \
  --flow authorization_code \
  --client-id 1479302369723285736 \
  --redirect-uri http://127.0.0.1:11111/callback \
  --scope "identify email connections guilds guilds.members.read messages.read openid"

Technical Analysis

The documented OAuth workflow directs all users through the fixed Discord OAuth client ID 1479302369723285736. The project does not identify who controls this application or instruct users to create and verify an application under their own control.

The recommended and purportedly minimal configurations also request several permissions simultaneously, including access to the user's email address, linked third-party accounts, guild list, and guild membership information. These permissions exceed the needs of common operations such as re ...[truncated 2008 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed client ID from the default instructions and require users to provide an OAuth client ID belonging to an application they created or explicitly verified.
2. Clearly identify the owner, purpose, privacy policy, and trust boundary of any preconfigured OAuth application if retaining one is unavoidable.
3. Default to the smallest operation-specific scope. For basic profile retrieval, request only identify.
4. Add email, connections, guilds, and guilds.members.read individually and only after the user explicitly requests functionality that requires each scope.
5. Remove messages.read from the recommended HTTP API flow because the skill itself notes that it does not enable HTTP channel-message access.
6. Present the exact data exposed by every requested scope before starting authorization and require explicit confirmation for sensitive scopes.
7. Document credential revocation and cleanup procedures so users can revoke the Discord authorization and delete the locally stored UXC credential after use.
8. Add validation checks that reject bundled broad scopes in examples designated as minimal.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill operates the Discord HTTP API through UXC with Discord OpenAPI schema support. However, the supplied code chunk does not call Discord, UXC APIs, or perform any network/API operations at all. It is purely a local validation script for repository files, ensuring the skill documentation contains required commands, auth-header examples, and metadata fields. That is a materially different primary purpose from the declared behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.