Security audit

Discord Connect UI

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Discord integration, but it can automatically change and restart Clawdbot while handling bot tokens in ways that are not fully safe or accurately described.

Review before installing. Run only in a test Clawdbot checkout first, use dry-run and skip-restart options where possible, back up the gateway/UI source tree, avoid passing live Discord tokens on the command line, prefer a real secret manager, grant the bot minimal Discord permissions, and be prepared for manual cleanup if uninstalling.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: assets/discord-backend.ts:400
Finding: Discord Bot Token Is Stored in an Inconsistent Plaintext Configuration Field
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test-token.py:67
Finding: Discord Bot Tokens Are Accepted and Documented Through Process Arguments
Content: View full analysis
1: token = sys.argv[1] else: token = os.environ.get("DISCORD_BOT_TOKEN", "") ``` From `scripts/health-check.py`: ```python parser = argparse.ArgumentParser(description="Discord bot health check") parser.add_argument("--token", help="Discord bot token") parser.add_argument("--verbose", "-v", action="store_true", help="Verbose output") parser.add_argument("--json", action="store_true", help="JSON output") args = parser.parse_args() token = args.token or os.environ.get("DISCORD_BOT_TOKEN", "") ``` Documented usage in `SKILL.md`: ```bash # Test token independently python scripts/test-token.py YOUR_TOKEN ``` Documented usage in `references/troubleshooting.md`: ```bash # Run health check ./scripts/health-check.py --token YOUR_TOKEN # Test token only ./scripts/test-token.py YOUR_TOKEN ``` ### Technical Analysis The scripts accept the complete bot credential through the process argument vector, and the project documentation actively recommends this usage. Command-line arguments may be exposed through shell history, process inspection interfaces, terminal session recording, CI/CD logs, command auditing, crash reports, and monitoring telemetry. Masking the token when the script later prints status does not protect the original command line. Reading the credential from `DISCORD_BOT_TOKEN` avoids the process argument vector but can still expose it to child processes, diagnostic dumps, or environment-capturing tools. A hidden interactive prompt, protected standard in ...[truncated 1233 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install-plugin.js:179
Finding: Automatic Installer Performs Non-Transactional Host Source Modification Without Reliable Rollback
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Claiming full Discord integration while apparently only validating tokens and listing guilds is a meaningful security concern because it can induce users to disclose credentials and approve invasive installation assumptions under false pretenses. The mismatch is more dangerous here because the skill discusses automatic backend/UI changes and bot-token handling, both of which are high-trust operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Claiming full Discord integration while apparently only validating tokens and listing guilds is a meaningful security concern because it can induce users to disclose credentials and approve invasive installation assumptions under false pretenses. The mismatch is more dangerous here because the skill discusses automatic backend/UI changes and bot-token handling, both of which are high-trust operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Claiming full Discord integration while apparently only validating tokens and listing guilds is a meaningful security concern because it can induce users to disclose credentials and approve invasive installation assumptions under false pretenses. The mismatch is more dangerous here because the skill discusses automatic backend/UI changes and bot-token handling, both of which are high-trust operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Claiming full Discord integration while apparently only validating tokens and listing guilds is a meaningful security concern because it can induce users to disclose credentials and approve invasive installation assumptions under false pretenses. The mismatch is more dangerous here because the skill discusses automatic backend/UI changes and bot-token handling, both of which are high-trust operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code reads the configured bot token from config.channels?.discord?.botToken but discordSetToken writes it to config.channels.discord.token. As a result, the newly saved token is never used by the rest of the handlers, causing authentication failures, misleading connection state, and potentially leaving an older token active if one exists under the read key. In a credential-management skill, this inconsistency is especially dangerous because operators may believe they rotated or fixed a secret when the running system still uses stale credentials.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation and comments claim the handler saves the Discord token to configuration, but it writes a different field than the rest of the backend reads. That creates a silent configuration integrity bug: the UI or caller receives a success result and restart notice even though subsequent operations will still report no token or use the wrong one. In this skill’s context, which automates credential management and service restarts, deceptive success states increase the likelihood of outage and failed secret rotation.
Content: No source excerpt is available for this finding.

Instruction Override

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Content: Scanner excerpt · references/bot-setup.md (reported line 138)May include surrounding context.
md
### Finding IDs 1. Enable Developer Mode: User Settings → Advanced → Developer Mode 2. Right-click server/channel/user → **Copy ID** ## Bot Presence

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/troubleshooting.md (reported line 228)May include surrounding context.
bash
# Reset discord state (if applicable) rm ~/.clawdbot/data/discord-*.json # Restart to rebuild state clawdbot gateway restart

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill describes installation steps, token validation, health checks, and automatic integration actions that imply network access and environment interaction, yet it declares no explicit tool scope or permissions. This weakens user visibility and policy enforcement, increasing the chance that an agent executes networked or environment-modifying actions without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation section says the skill will automatically install components, update navigation, register handlers, and later notes a build and gateway restart, but it does not present this as a prominent risk warning. Silent or under-disclosed local code modification and service restart can disrupt systems, bypass change-management expectations, and create an opportunity for persistence if the skill is abused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to paste a Discord bot token and describes storage options, but it does not provide a strong warning about credential sensitivity, redaction, least exposure, and secure handling. Because bot tokens grant remote control over a Discord bot and often access to multiple servers, weak disclosure around handling can lead to accidental leakage in logs, chat transcripts, config files, or screenshots.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This handler performs two safety-relevant actions: it persists a credential to the config file and schedules a process restart so the new token takes effect. Although the returned message mentions the restart after the fact, there is no prior confirmation prompt or explicit user-facing warning before making these changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The post-install hook automatically executes a gateway restart via execSync without explicit prior consent. Automatic service restarts can interrupt active workloads, create denial-of-service conditions for users, and in this skill are more sensitive because the installer also patches core application files and immediately activates those changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The uninstall hook deletes files recorded in installContext.installedFiles without any user confirmation or safety check. In a plugin that modifies host application files, this can cause unexpected data loss or break the gateway/UI if the tracked paths are stale, incorrect, or influenced by prior install state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The troubleshooting guide instructs users to pass a raw Discord bot token directly on the command line, which can expose the credential through shell history, process listings, terminal scrollback, and logging systems. Because this is operational documentation for a live integration, the token is a high-value secret and the lack of handling guidance creates a realistic credential-leak risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Resetting a bot token is a sensitive, potentially disruptive action because it invalidates the previous credential and requires secure storage of the new one. The document presents this as a routine fix but does not warn about operational impact or safe handling of the regenerated secret.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The recovery procedure tells users to delete local Discord state files without clearly warning that the action is destructive and may remove cached guild/channel state or other local operational data. In troubleshooting documentation, destructive remediation without backup guidance can cause avoidable data loss or service disruption, especially if copied verbatim under time pressure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code builds an Authorization header from the supplied bot token and sends it over HTTP requests to Discord. While the script's health-check purpose implies network access, it does not explicitly warn users that their credential will be transmitted to external endpoints as part of validation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/install-plugin.js (reported line 366)May include surrounding context.
js
removeFile(path.join(gatewayPath, "src/gateway/server-methods/discord-connect.ts")); removeFile(path.join(uiPath, "src/ui/views/discord.ts")); // Note: We don't automatically remove patches from server-methods.ts, // navigation.ts, and app-render.ts as it's safer to do manually log("");

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: assets/install-hooks.js:247

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install-plugin.js:318