Discord Chat 基础

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.1

Overview

This Discord chat skill is not malicious, but it requests broad local file and command tools that do not fit its documented Discord messaging purpose.

Review before installing. Only enable this skill in an environment where the declared read, write, and exec tools are removed or tightly sandboxed, and use it only for explicitly authorized Discord channels. Treat Discord history and callback URLs as sensitive because they may expose private messages or task output outside the chat system.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:25

Finding

Excessive and Mismatched Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–28
Vulnerability Type: Least-privilege violation and capability mismatch
Risk Level: Medium

Vulnerable Code:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares local filesystem read and write capabilities as well as arbitrary command execution. These permissions are not required for its documented purpose, which is limited to sending, replying to, reading, and reacting to Discord messages through the message tool.

The declared capabilities therefore do not match the documented workflows. In particular, the skill requests read, write, and exec, while the message capability used throughout its examples is absent from the declaration. Granting unnecessary local capabilities violates the principle of least privilege and expands the consequences of malicious, misleading, or untrusted input.

No direct malicious command or confirmed exploitation payload is present in the audited file. The risk arises from the unnecessarily broad permissions made available when the skill is loaded or invoked.

Attack Path

1. An agent loads the skill and grants its declared read, write, and exec capabilities.
2. The skill processes attacker-controlled user input or untrusted content obtained from a Discord channel.
3. Crafted content induces the agent to perform an operation outside the legitimate Discord messaging scope.
4. Because the skill has unnecessary local capabilities, the induced operation may read local files, modify accessible data, or execute a local command.
5. The operation runs with the permissions of the hosting agent process, extending the potential impact beyond Discord.

Impact Assessment

Successful exploitation could permit access to files readable by the agent process, modification of files writable by that process, or execution of commands under the agent's operating-system ide ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read, write, and exec from the skill's tool declaration.
2. Declare only the Discord message capability required by the documented workflows.
3. Restrict messaging operations to explicitly authorized Discord servers and channels where supported.
4. Apply action-level controls so the skill can perform only the documented send, reply, read, and reaction operations.
5. Require confirmation for operations involving destinations not explicitly supplied or approved by the user.
6. Treat Discord messages and other external content as untrusted data and prevent them from authorizing tool calls or changing the skill's operational scope.
7. If a future feature genuinely requires local file or command access, isolate it into a separately reviewed capability with narrow path, command, argument, and runtime restrictions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description is broad and marketing-heavy, with few constraints on when the skill should be invoked or what inputs are safe. In agent environments, vague activation criteria can cause over-triggering and unintended use of read/write-capable tooling, increasing the chance of accidental data exposure or unintended outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting an optional callback URL without warning about external transmission creates a clear data exfiltration risk. Users or agents may send task outputs, message contents, or metadata to arbitrary endpoints without understanding the trust boundary or validating destination ownership.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents reading Discord history but does not warn that retrieved messages may include sensitive personal, operational, or confidential data. Because the skill also supports downstream message handling, an agent may ingest more context than necessary and expose or reuse it inappropriately.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The display name, summaries, and nearly all instructional content are presented in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.