Security audit

Discord Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Discord digest tool, but it asks for and persists a full Discord user token in ways that can expose the account and private server content.

Install only if you are comfortable giving this skill a Discord user session token and having Discord message content summarized locally. Avoid typing tokens into shell commands, avoid plaintext config storage, restrict configured channels to non-sensitive spaces, and do not forward digests to Telegram or other services without permission from affected communities. A bot or OAuth flow with limited permissions would be safer.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config_manager.py:21
Finding: Discord User Token Stored in Plaintext Without Enforced File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/discord_api.py:165
Finding: Discord Token Accepted Through Command-Line Arguments
Content: View full analysis
[args...]") print("Actions: validate, guilds, channels , messages [hours]") sys.exit(1) token = sys.argv[1] action = sys.argv[2] ``` The configuration utility also accepts the token through an argument: ```python elif action == "set-token" and len(sys.argv) > 2: set_token(sys.argv[2]) ``` The documented setup commands explicitly instruct users to provide the token this way. ### Technical Analysis Command-line arguments are not an appropriate transport for bearer credentials. Depending on the operating system and process isolation settings, arguments may be visible to other local users or monitoring software through process listings, `/proc`, process accounting, endpoint telemetry, crash reports, or orchestration logs. Interactive shell commands are also commonly retained in shell history. Consequently, the token can remain recoverable after the Python process exits. The same exposure occurs both when saving the token and when directly invoking Discord API actions. No shell-command injection was found because the value is consumed through `sys.argv` rather than interpolated into a shell command. The defect is credential disclosure, not command execution. ### Attack Path 1. The user follows the documented command and supplies a Discord token as a positional argument. 2. While the command is running, another local principal or monitoring agent captures its argument vector, or the shell records the command in history. 3. The attacker retrieves the token from the process record, telemetry, or hi ...[truncated 581 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/discord_api.py:13
Finding: Full Discord User Session Token Exceeds Least Privilege Required for Read-Only Digests
Content: View full analysis
dict: return { "Authorization": token, "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" } def _request(token: str, endpoint: str, max_retries: int = 3) -> Optional[dict]: """Make authenticated request to Discord API with rate limit handling.""" url = f"{API_BASE}{endpoint}" headers = _headers(token) req = urllib.request.Request(url, headers=headers) ``` ### Technical Analysis The declared function is to read selected channels and generate digests, but the skill authenticates with a Discord user session token. Such a bearer credential represents the user's broader Discord session rather than a purpose-built identity restricted to the minimum servers, channels, and read operations required by the skill. The code itself only constructs `GET` requests and the API base is fixed to `https://discord.com/api/v10`; therefore, the static pre-scan's sensitive network transmission is functionally necessary and is not an arbitrary exfiltration endpoint. HTTPS is used, and no code was found that transmits the token to a non-Discord host. Nevertheless, the credential being transmitted and retained has substantially greater value than the task requires. If it is exposed through the plaintext configuration, command-line arguments, host compromise, or future code changes, an attacker receives the authority represented by the user session rather than a narrowly scoped digest-reader credential. The documentation acknowledges that user-token automation may violate Discord's Terms of Service. This also creates an accou ...[truncated 1280 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior claims sensitive token use, Discord API access, token validation, and multi-server digesting, but the analyzed artifact does not substantiate those capabilities. This mismatch is dangerous because users may be induced to provide a Discord user token and trust data-handling or validation behaviors that are not actually implemented or auditable in the presented skill file.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The setup explicitly instructs users to extract a Discord user token from browser developer tools and store it locally, without a strong warning that this is a highly sensitive account credential. This can lead to account compromise, policy violations, and unsafe long-term storage of a reusable secret in a local config file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to extract a Discord user token from browser developer tools and store it for later use, but does not provide strong credential-handling warnings or safer alternatives. A Discord user token is a highly sensitive credential that can grant full account access, so normalizing manual extraction and local storage materially increases the risk of account compromise, especially in an automation context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The cron example instructs users to send generated Discord digest output to Telegram without warning that message content, links, and potentially sensitive server information will be transmitted to a third-party service. This creates a real risk of unintended data exfiltration from private Discord servers or threads, particularly because the feature is framed as routine automation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and documents network access, token handling, and local config writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and can cause the agent to invoke broader file, network, or environment capabilities than a reviewer or user would expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description says to use the skill for 'monitoring Discord channels' and 'creating Discord activity reports' without defining clear trigger phrases, scope limits, or exclusion conditions. These broad natural-language cues could overlap with ordinary user requests and cause unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill describes generating digests from Discord channels but does not clearly disclose the privacy implications of reading message content and transmitting authenticated account data to Discord APIs. Users may enable the skill without understanding that private or sensitive channel content will be processed and summarized.
Content: No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 9, credential/environment) → open (file write)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/config_manager.py (reported line 23)May include surrounding context.
python
def save_config(config: dict): """Save config to file.""" os.makedirs(CONFIG_DIR, exist_ok=True) with open(CONFIG_FILE, 'w') as f: json.dump(config, f, indent=2, ensure_ascii=False) print(f"✅ Config saved to {CONFIG_FILE}")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script stores a Discord user token in plaintext JSON on disk, which creates credential exposure risk if the host is shared, backed up, indexed, or has weak filesystem permissions. In this skill's context, the token is especially sensitive because it grants access to Discord account data across selected servers and channels, so theft could enable unauthorized monitoring or account misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The CLI accepts a Discord user token as a positional argument, which can expose the credential through shell history, process listings, audit logs, or job runners. In this skill's context, that is especially sensitive because the token is a user token with broad account access, not a narrowly scoped API key, so accidental disclosure could let an attacker impersonate the user and access Discord data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function docstring says it gets active threads in a channel, but L101 calls the archived public threads endpoint and L114 explicitly notes that the active threads endpoint is actually on guild, not channel. This is an intent/documentation contradiction rather than a mere omission, because the function advertises one behavior while performing another.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.