ClawHub
Back to skill

Security audit

Discord Chat 基础

Security checks for vulnerabilities and agentic risk

Overview

The skill's Discord messaging purpose is mostly clear, but it requests broad exec/write authority and includes under-disclosed credential and callback URL guidance that users should review before installing.

Install only if you are comfortable giving the skill broader local tool authority than its Discord examples appear to require. Use it only in channels where the bot is authorized, keep history reads small, avoid sensitive channels unless participants consent, and do not provide a callback URL unless you control and trust the endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is for basic Discord messaging, but it also documents generic LLM/API key setup and shell export usage that are not clearly required for the stated capability. This expands the perceived trust boundary and can mislead users into exposing credentials or enabling broader platform access than necessary, especially when combined with the declared `exec` tool.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The documentation presents the skill as a limited free Discord chat helper, yet the manifest exposes `exec` and includes command-style guidance. Even if no overtly dangerous command is shown, this mismatch normalizes command execution in a skill whose stated purpose is only send/read/react messaging, increasing the chance of unnecessary code execution or privilege expansion.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly supports reading recent Discord channel history but does not warn users that this may expose other participants' messages, sensitive operational details, or private community content to the agent workflow. In a communication skill, history-reading is contextually legitimate, but the lack of privacy notice and consent guidance makes accidental over-collection more likely.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Documenting a `callback_url` parameter without warning that data may be sent to an external endpoint creates a direct exfiltration risk. Users may provide URLs they do not control or fail to realize that task results, message content, or metadata could be transmitted off-platform, which is especially sensitive in a Discord integration handling channel communications.

Static analysis

No suspicious patterns detected.