Discrawl Search

Search Discord message history via discrawl SQLite database. Use when the user asks about past conversations, previous discussions, historical messages, or a...

Security Scan

The skill is coherent with its stated purpose (searching a local Discrawl SQLite DB) but has a few manifest/instruction omissions and a small implementation risk (unsanitized shell SQL) you should review before use.

Purpose & Capability

The skill's name, description, SKILL.md, and included scripts all consistently target searching a local Discrawl SQLite database (~/.discrawl/discrawl.db). However, the runtime assumes the 'discrawl' CLI is available and that the local DB exists, yet the manifest declares no required binaries or config paths — a minor inconsistency in declarations (the skill does need access to the local DB and a discrawl binary to function).

Instruction Scope

SKILL.md and scripts instruct the agent to read/query the local Discrawl database (message contents, raw_json, members, channels). The script and examples also allow/encourage raw SQL queries and the provided search_history.sh directly interpolates user-supplied query and channel into SQL strings executed via the discrawl CLI. This creates two concerns: (1) the manifest does not declare the config path (~/.discrawl/discrawl.db) even though the skill reads it, and (2) the script is vulnerable to SQL-injection or shell-escaping issues if untrusted input is used. There are no instructions to send data to external endpoints.

Install Mechanism

There is no install spec (instruction-only), so nothing will be downloaded or written during install. The included script expects the 'discrawl' CLI to be present; absence of an install instruction is reasonable but the manifest should have declared the dependency.

Credentials

The skill requests no environment variables or credentials, which is proportionate. However it does access sensitive local data (Discord messages and raw_json in ~/.discrawl/discrawl.db). That access is consistent with the purpose but represents a privacy-sensitive capability the user should be aware of.

Persistence & Privilege

The skill is not marked always:true and doesn't request elevated platform privileges or modification of other skills. It is user-invocable and can be invoked autonomously per platform default; that is expected for skills of this kind.

Assessment

This skill appears to do what it says: query a local Discrawl SQLite database. Before installing or enabling it, confirm the following: 1) The agent environment actually has the 'discrawl' CLI and the database at ~/.discrawl/discrawl.db (the manifest did not declare these). 2) Understand privacy implications — the skill can read all stored Discord messages (raw_json, attachments metadata, etc.). Only enable it if you trust the agent and the environment. 3) The provided script interpolates user input directly into SQL executed via the shell; if you or the agent supply untrusted input this can break queries or be abused. If you plan to use this skill with external inputs, sanitize/parameterize queries or restrict to read-only, pre-built queries. 4) If you need stronger guarantees, ask the author to: declare the discrawl binary and config path in the manifest, add input sanitization or parameterized SQL, and include an install/check step that validates the DB path and permissions. If you are unsure, test the script locally on a copy of the DB first or run it in a restricted/sandboxed environment.

Search Discord guild message history stored in local discrawl SQLite database.

Database Location

• Path: ~/.discrawl/discrawl.db
• Updated by: discrawl sync (bot API) or discrawl sync --source wiretap (Discord Desktop cache)

Quick Commands

Full-Text Search (FTS5)

Search message content with ranking:

discrawl search "query"

Options:

• --limit N — max results (default: 20)
• --channel ID — filter by channel
• --author ID — filter by author
• --before "2026-04-01" — date filter
• --json — JSON output

List Messages by Channel

discrawl messages --channel <channel_id> --limit 10

Raw SQL Queries

discrawl sql "SELECT ..."

Common Query Patterns

Search with Context (Author + Channel Names)

SELECT
  m.content,
  m.created_at,
  COALESCE(u.username, m.author_id) as author,
  COALESCE(c.name, m.channel_id) as channel
FROM messages m
LEFT JOIN members u ON m.author_id = u.user_id
LEFT JOIN channels c ON m.channel_id = c.id
WHERE m.content LIKE '%keyword%'
ORDER BY m.created_at DESC
LIMIT 10;

Search Specific Channel History

SELECT content, created_at
FROM messages
WHERE channel_id = '<channel_id>'
  AND content LIKE '%keyword%'
ORDER BY created_at DESC
LIMIT 20;

Find User's Past Messages

SELECT m.content, m.created_at, c.name
FROM messages m
JOIN channels c ON m.channel_id = c.id
WHERE m.author_id = '<user_id>'
ORDER BY m.created_at DESC
LIMIT 20;

Search with FTS5 (Best Relevance)

SELECT
  m.content,
  m.created_at,
  fts.rank
FROM message_fts fts
JOIN messages m ON fts.message_id = m.id
WHERE message_fts MATCH 'keyword'
ORDER BY rank
LIMIT 20;

Recent Messages in Channel

SELECT content, created_at
FROM messages
WHERE channel_id = '<channel_id>'
ORDER BY created_at DESC
LIMIT 5;

Key Tables

Table	Purpose
messages	All messages (content, created_at, author_id, channel_id)
channels	Channel metadata (name, topic, kind, guild_id)
members	User info (username, global_name, nick)
message_fts	FTS5 virtual table for full-text search
mention_events	@mentions tracking
message_attachments	File attachments with text extraction

Important Notes

• members table may be sparse (2 rows in current db) — use COALESCE(u.username, m.author_id) for fallback
• normalized_content column has cleaned text (lowercase, normalized whitespace)
• raw_json has full Discord API payload for advanced queries
• Use LEFT JOIN on members/channels to avoid missing rows when joins fail