ClawHub
Back to skill

Security audit

discrawl-search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed helper for searching a local Discord archive, with privacy-sensitive but purpose-aligned read access.

Install only if you want an agent to search your local Discord archive. Prefer the bounded discrawl search commands or the helper script, keep limits and channel or author filters tight, and do not use the SQL examples with values copied from an untrusted user request.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill correctly warns not to place user-provided values into SQL, but then undermines that guidance by providing copyable query templates with inline placeholders such as '<channel_id>', '<user_id>', and 'keyword' embedded in SQL strings. In practice, an agent or operator may substitute untrusted user input directly into these examples, causing SQL injection risk against the local Discord archive and potentially exposing or broadening access to sensitive private message data.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The read-only SQL section operates over highly sensitive Discord history, including message contents, author identifiers, channel metadata, attachments, and raw payloads, yet the example queries normalize direct retrieval of this data without a strong warning about privacy exposure and scope control. Even without write access, executing these queries can reveal large amounts of private workspace information if an agent over-collects, searches the wrong scope, or returns results beyond the user's intended authorization.

Static analysis

No suspicious patterns detected.