Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Discord

v1.0.2

Control Discord via Clawdbot to send messages, react, post stickers/emojis, run polls, manage threads/pins/search, fetch info, and moderate channels or DMs.

1· 237·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for fresh3/taizi-discord.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Discord" (fresh3/taizi-discord) from ClawHub.
Skill page: https://clawhub.ai/fresh3/taizi-discord
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install taizi-discord

ClawHub CLI

Package manager switcher

npx clawhub@latest install taizi-discord
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md consistently describes Discord management capabilities (messages, reactions, uploads, polls, moderation). However, it implicitly depends on a pre-configured 'discord' tool and a Clawdbot bot token while the skill metadata declares no required binaries, config paths, or credentials. That mismatch (implicit credential/tool assumption not declared) is an inconsistency.
!
Instruction Scope
Runtime instructions allow reading local files via file:/// (for media/emoji/sticker uploads) and performing sensitive Discord operations (readMessages, searchMessages, memberInfo, role changes, moderation). Reading arbitrary local files and uploading them to Discord is explicitly supported and could be used to exfiltrate sensitive local data if misused. The instructions otherwise stay within Discord-related actions and don't instruct reading unrelated system files or env vars, but the local-file upload capability and broad message/member access are notable risks.
Install Mechanism
There is no install spec and no code files; the skill is instruction-only. That minimizes on-disk installation risk. The SKILL.md assumes an existing 'discord' tool/environment but does not install anything itself.
!
Credentials
The skill does not declare any required environment variables or primary credential, yet the documentation explicitly says it uses 'the bot token configured for Clawdbot.' Relying on an undeclared bot token (or other agent configuration) is a proportionality and transparency issue: users may not realize the skill needs access to the bot token or other service credentials to function.
Persistence & Privilege
The skill does not request permanent/always-on inclusion and uses the default agent-invocation model. That is normal. However, because the skill can perform privileged Discord operations (moderation, role changes) — even though those groups default to disabled — allowing autonomous invocation without explicit restrictions increases blast radius if the agent is granted those permissions.
What to consider before installing
This instruction-only Discord skill appears to do what it claims, but there are important surprises to be aware of: it implicitly expects a pre-configured 'Clawdbot' bot token and a 'discord' tool on the agent even though no credentials or binaries are declared; it allows uploading local files (file:/// paths), which will read and transmit files from the agent host to Discord; and it supports powerful moderation and role-change actions (disabled by default) that require high privileges. Before installing: 1) confirm where the Clawdbot token is stored and whether you are willing to expose it to this skill; 2) limit the bot's permission scope on Discord (least privilege) and keep moderation/roles disabled unless explicitly needed; 3) restrict or audit the agent's filesystem access if you do not want arbitrary local files uploaded; 4) test in a non-production server first; and 5) prefer a skill with an explicit homepage/source or clear declaration of required credentials/tools — ask the publisher for the source code or details if you need higher assurance.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fqcskfz0kh0htb7hm2g9vxx834sth
237downloads
1stars
1versions
Updated 21h ago
v1.0.2
MIT-0

Discord Actions

Overview

Use discord to manage messages, reactions, threads, polls, and moderation. You can disable groups via discord.actions.* (defaults to enabled, except roles/moderation). The tool uses the bot token configured for Clawdbot.

Inputs to collect

  • For reactions: channelId, messageId, and an emoji.
  • For stickers/polls/sendMessage: a to target (channel:<id> or user:<id>). Optional content text.
  • Polls also need a question plus 2–10 answers.
  • For media: mediaUrl with file:///path for local files or https://... for remote.
  • For emoji uploads: guildId, name, mediaUrl, optional roleIds (limit 256KB, PNG/JPG/GIF).
  • For sticker uploads: guildId, name, description, tags, mediaUrl (limit 512KB, PNG/APNG/Lottie JSON).

Message context lines include discord message id and channel fields you can reuse directly.

Note: sendMessage uses to: "channel:<id>" format, not channelId. Other actions like react, readMessages, editMessage use channelId directly.

Actions

React to a message

{
  "action": "react",
  "channelId": "123",
  "messageId": "456",
  "emoji": "✅"
}

List reactions + users

{
  "action": "reactions",
  "channelId": "123",
  "messageId": "456",
  "limit": 100
}

Send a sticker

{
  "action": "sticker",
  "to": "channel:123",
  "stickerIds": ["9876543210"],
  "content": "Nice work!"
}
  • Up to 3 sticker IDs per message.
  • to can be user:<id> for DMs.

Upload a custom emoji

{
  "action": "emojiUpload",
  "guildId": "999",
  "name": "party_blob",
  "mediaUrl": "file:///tmp/party.png",
  "roleIds": ["222"]
}
  • Emoji images must be PNG/JPG/GIF and <= 256KB.
  • roleIds is optional; omit to make the emoji available to everyone.

Upload a sticker

{
  "action": "stickerUpload",
  "guildId": "999",
  "name": "clawdbot_wave",
  "description": "Clawdbot waving hello",
  "tags": "👋",
  "mediaUrl": "file:///tmp/wave.png"
}
  • Stickers require name, description, and tags.
  • Uploads must be PNG/APNG/Lottie JSON and <= 512KB.

Create a poll

{
  "action": "poll",
  "to": "channel:123",
  "question": "Lunch?",
  "answers": ["Pizza", "Sushi", "Salad"],
  "allowMultiselect": false,
  "durationHours": 24,
  "content": "Vote now"
}
  • durationHours defaults to 24; max 32 days (768 hours).

Check bot permissions for a channel

{
  "action": "permissions",
  "channelId": "123"
}

Ideas to try

  • React with ✅/⚠️ to mark status updates.
  • Post a quick poll for release decisions or meeting times.
  • Send celebratory stickers after successful deploys.
  • Upload new emojis/stickers for release moments.
  • Run weekly “priority check” polls in team channels.
  • DM stickers as acknowledgements when a user’s request is completed.

Action gating

Use discord.actions.* to disable action groups:

  • reactions (react + reactions list + emojiList)
  • stickers, polls, permissions, messages, threads, pins, search
  • emojiUploads, stickerUploads
  • memberInfo, roleInfo, channelInfo, voiceStatus, events
  • roles (role add/remove, default false)
  • moderation (timeout/kick/ban, default false)

Read recent messages

{
  "action": "readMessages",
  "channelId": "123",
  "limit": 20
}

Send/edit/delete a message

{
  "action": "sendMessage",
  "to": "channel:123",
  "content": "Hello from Clawdbot"
}

With media attachment:

{
  "action": "sendMessage",
  "to": "channel:123",
  "content": "Check out this audio!",
  "mediaUrl": "file:///tmp/audio.mp3"
}
  • to uses format channel:<id> or user:<id> for DMs (not channelId!)
  • mediaUrl supports local files (file:///path/to/file) and remote URLs (https://...)
  • Optional replyTo with a message ID to reply to a specific message
{
  "action": "editMessage",
  "channelId": "123",
  "messageId": "456",
  "content": "Fixed typo"
}
{
  "action": "deleteMessage",
  "channelId": "123",
  "messageId": "456"
}

Threads

{
  "action": "threadCreate",
  "channelId": "123",
  "name": "Bug triage",
  "messageId": "456"
}
{
  "action": "threadList",
  "guildId": "999"
}
{
  "action": "threadReply",
  "channelId": "777",
  "content": "Replying in thread"
}

Pins

{
  "action": "pinMessage",
  "channelId": "123",
  "messageId": "456"
}
{
  "action": "listPins",
  "channelId": "123"
}

Search messages

{
  "action": "searchMessages",
  "guildId": "999",
  "content": "release notes",
  "channelIds": ["123", "456"],
  "limit": 10
}

Member + role info

{
  "action": "memberInfo",
  "guildId": "999",
  "userId": "111"
}
{
  "action": "roleInfo",
  "guildId": "999"
}

List available custom emojis

{
  "action": "emojiList",
  "guildId": "999"
}

Role changes (disabled by default)

{
  "action": "roleAdd",
  "guildId": "999",
  "userId": "111",
  "roleId": "222"
}

Channel info

{
  "action": "channelInfo",
  "channelId": "123"
}
{
  "action": "channelList",
  "guildId": "999"
}

Voice status

{
  "action": "voiceStatus",
  "guildId": "999",
  "userId": "111"
}

Scheduled events

{
  "action": "eventList",
  "guildId": "999"
}

Moderation (disabled by default)

{
  "action": "timeout",
  "guildId": "999",
  "userId": "111",
  "durationMinutes": 10
}

Discord Writing Style Guide

Keep it conversational! Discord is a chat platform, not documentation.

Do

  • Short, punchy messages (1-3 sentences ideal)
  • Multiple quick replies > one wall of text
  • Use emoji for tone/emphasis 🦞
  • Lowercase casual style is fine
  • Break up info into digestible chunks
  • Match the energy of the conversation

Don't

  • No markdown tables (Discord renders them as ugly raw | text |)
  • No ## Headers for casual chat (use bold or CAPS for emphasis)
  • Avoid multi-paragraph essays
  • Don't over-explain simple things
  • Skip the "I'd be happy to help!" fluff

Formatting that works

  • bold for emphasis
  • code for technical terms
  • Lists for multiple items
  • quotes for referencing

  • Wrap multiple links in <> to suppress embeds

Example transformations

❌ Bad:

I'd be happy to help with that! Here's a comprehensive overview of the versioning strategies available:

## Semantic Versioning
Semver uses MAJOR.MINOR.PATCH format where...

## Calendar Versioning
CalVer uses date-based versions like...

✅ Good:

versioning options: semver (1.2.3), calver (2026.01.04), or yolo (`latest` forever). what fits your release cadence?

Comments

Loading comments...