Discrawl

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 1.0.0

Overview

The skill matches its Discord archive purpose, but it needs review because it can inspect private DMs/local Discord artifacts and installs a mutable Go binary.

Install only if you are comfortable letting the agent search local Discord archives and potentially DMs. Prefer a pinned Discrawl version, and only allow DM or bot-backed sync use for datasets and workspaces you are authorized to inspect.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Go Dependency Allows Mutable Supply-Chain Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-14
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

yaml

install:
  - kind: go
    module: github.com/openclaw/discrawl/cmd/discrawl@latest
    bins:
      - discrawl

Technical Analysis

The installation configuration retrieves github.com/openclaw/discrawl/cmd/discrawl@latest. The @latest selector is mutable and may resolve to a different release over time. Consequently, the code installed later may differ from the version that was available when this Skill was audited.

The dependency path corresponds to the repository declared as the Skill homepage, and no evidence of an existing malicious package was identified. Nevertheless, using a mutable version prevents reproducible installation and creates a supply-chain trust dependency on future upstream releases, repository maintainers, hosting infrastructure, and account security.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its release process.
2. The attacker publishes a malicious Go module version that becomes the version selected by @latest.
3. A user installs or reinstalls the Skill dependency.
4. The Go toolchain retrieves and builds the compromised version.
5. When the resulting discrawl binary is invoked, attacker-controlled code executes with the privileges of the user running the agent.

Impact Assessment

Successful exploitation could permit arbitrary local code execution with the installing or invoking user's permissions. Because the declared functionality processes local Discord archives and may use configured Discord bot credentials, compromised code could potentially access, alter, or disclose data available to that user and process. The precise scope would remain limited by operating-system permissions, credential availability, and runtime isolation.

No embedded malicious code, instruction ...[truncated 135 chars]

Remediation

View remediation

Remediation Suggestions

Replace @latest with a specific reviewed release version, for example:

yaml

install:
  - kind: go
    module: github.com/openclaw/discrawl/cmd/discrawl@vX.Y.Z
    bins:
      - discrawl

Apply the following hardening measures:

1. Pin the dependency to a known, reviewed semantic version rather than a mutable selector.
2. Validate the selected module through the Go checksum database and retain go.sum or equivalent integrity information where supported by the Skill installation system.
3. Review upstream release provenance, maintainers, source changes, and build artifacts before updating the pinned version.
4. Adopt an explicit dependency-update process that requires security review before changing the pin.
5. Where practical, verify signed release tags or reproducible-build metadata and run the installed binary with only the filesystem and credential access required for archive operations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The default prompt authorizes broad use of the skill to search local Discord archives, inspect DMs, and report source gaps without stating when use is appropriate, what data sources are in scope, or what authorization checks must apply. That ambiguity can cause an agent to invoke the skill in privacy-sensitive contexts or over-collect data beyond user intent, especially because Discord archives and DMs commonly contain sensitive personal or confidential information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Referencing DM inspection in the manifest without any privacy warning or consent requirement normalizes access to highly sensitive private communications. In agent contexts, this increases the risk that the tool is invoked on private messages without clear user awareness, necessity, or authorization, which can expose personal data, confidential business information, or privileged conversations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.