ClawHub
Back to skill

Security audit

discrawl-search

Security checks across malware telemetry and agentic risk

Overview

The skill is for searching a user-authorized Discord archive, but it also exposes broad read-only SQL access over private message data in a way users should review carefully.

Install only if you are comfortable letting the agent search private Discord archive data and potentially use read-only SQL against the local discrawl database. Prefer the bounded discrawl search/messages commands or the helper script, and do not allow user-supplied text, IDs, dates, or channel names to be inserted directly into SQL.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The skill explicitly warns not to place user-provided values into SQL, but then includes concrete SQL templates that interpolate placeholders like keyword, channel_id, and user_id directly into query strings. In practice, this creates a strong risk that an agent or operator will substitute untrusted user input into `discrawl sql`, enabling SQL injection or at minimum bypass of the intended bounded-search interface over sensitive Discord archive data.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The manifest describes the skill as using bounded search and message commands, which suggests constrained access patterns, but the body also authorizes direct SQL usage for advanced access. This mismatch can mislead downstream agents or reviewers into treating the skill as safer than it is, increasing the chance that broader archive access is exposed through an interface expected to be narrowly scoped.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is presented as a bounded retrieval tool for user-authorized Discord history, but the documented behavior expands into arbitrary read-only SQL over the local archive, including access to raw payloads and broad table listings. Even if the SQL is read-only, this materially widens the accessible data surface and can defeat least-privilege assumptions by enabling unrestricted querying of private workspace data beyond the user's narrowly requested scope.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.