Discord Channel Auditor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:45 AM UTC
• Version: 1.0.1

Overview

This skill does what it says, but it can silently delete Discord guide-channel messages with broad message-management permission and weak targeting rules.

Install only if the bot's Manage Messages permission is restricted to the single guide channel and you are comfortable with automatic deletion/reposting there. Prefer adding rules that store created message IDs, verify bot authorship, skip pinned or user-authored messages, log planned changes, and require confirmation or dry-run review before scheduled updates mutate content.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Overprivileged Discord Message Management with Ambiguous Deletion Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–16 and 31
Vulnerability Type: Excessive Discord permissions and insufficiently constrained message deletion
Risk Level: Medium

Vulnerable Code

markdown

- Uses OpenClaw's built-in `message` tool for all Discord operations (`channel-list`, `read`, `send`, `delete`, `edit`)
- Bot must have "View Channel" permission in the guild to list channels
- Bot must have "Send Messages" + "Manage Messages" in the guide channel to post/delete

markdown

4. **If changes found:** Delete old guide messages and post fresh guide

Technical Analysis

The Skill explicitly requests Discord's Manage Messages permission and directs the Agent to delete “old guide messages.” This permission permits deletion of messages authored by other users within every channel where the permission is effective. It is broader than is ordinarily necessary if the guide consists only of messages previously posted by the bot, because a bot can edit or delete its own messages without receiving general authority to manage other users' messages.

The deletion instructions do not define a safe target-selection mechanism. In particular, they do not require the Agent to:

• Retain and use the IDs of guide messages created by the Skill.
• Verify that each targeted message was authored by the bot.
• Distinguish guide content from administrator or user messages.
• Exclude pinned messages.
• Request confirmation when ownership or purpose is uncertain.
• Prefer editing existing guide messages over deleting and recreating them.

The combination of an overbroad permission and an ambiguous deletion rule violates least-privilege principles. Natural-language interpretation errors, unexpected guide-channel content, or misleading messages could cause the Agent to delete content unrelated to the generated guide.

The Skill's Discord network activity is otherwise consistent with its de ...[truncated 1775 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Manage Messages from the default requirements when the Skill only manages bot-authored guide messages.
2. Prefer edit operations against known bot-owned messages instead of deleting and reposting the guide.
3. Persist the exact Discord message IDs created by the Skill and permit mutation only when a target ID matches that allowlist.
4. Before editing or deleting a message, verify that its author ID equals the configured bot identity.
5. Never delete pinned messages or messages authored by users, moderators, webhooks, or other bots.
6. If stored message IDs are missing or ownership cannot be verified, stop and request explicit administrator confirmation rather than scanning and deleting messages heuristically.
7. If Manage Messages is operationally unavoidable, grant it through a channel-specific override limited exclusively to the guide channel. Do not grant it at the guild or category level.
8. Add an explicit deletion limit and fail closed if more messages than expected would be affected.
9. Log target message IDs, authorship checks, and planned changes before mutation, while avoiding storage of unrelated message content.
10. For scheduled silent runs, use a dry-run comparison first and only apply changes when every target passes the ownership and scope checks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to delete existing guide messages and repost fresh content when changes are detected, but the description does not clearly warn users about this destructive behavior. That omission can cause unexpected message loss, accidental deletion of manually curated guide content, or disruptive edits in production channels, especially when run on a cron.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.