ClawHub
Back to skill

Security audit

Discord Chat Manager Free

Security checks for vulnerabilities and agentic risk

Overview

This Discord chat skill is mostly coherent, but it asks for broad local command execution and includes mismatched SEO triggers plus weak safeguards around message deletion and editing.

Review before installing. Use only with a least-privilege Discord bot, avoid granting Manage Messages unless deletion/editing is truly needed, require explicit confirmation before destructive actions, and remove or narrow exec access and the SEO trigger text before routine use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:5
Finding

Unnecessary General-Purpose Command Execution Permission

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permission and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: read exec

The excessive permission is also corroborated by the runtime classification at SKILL.md:248 and the recommendation to execute operating-system network diagnostics at SKILL.md:260.

Technical Analysis

The skill grants access to the general-purpose exec tool even though its declared functionality consists of Discord operations such as sending, reading, searching, editing, deleting, and reacting to messages. Those operations are documented as calls to a dedicated message tool and do not inherently require arbitrary local command execution.

The only documented justification for command execution is an optional network diagnostic using ping. Granting unrestricted exec for this narrow troubleshooting operation breaks the principle of least privilege. Unlike a fixed connectivity-check interface, a general execution tool may permit arbitrary programs, arguments, shell operators, filesystem operations, and network clients to run with the privileges of the hosting agent.

Discord message content is externally influenced and may be processed by the agent during read or search operations. If such content contains prompt-injection instructions and the agent follows them, the unnecessary exec permission expands the consequences from manipulation of Discord operations to local command execution.

Attack Path

  1. An attacker posts crafted content in a Discord channel accessible to the configured bot.
  2. A user asks the agent to read, search, or summarize messages from that channel.
  3. The agent receives the attacker-controlled message content in its tool results.
  4. The content attempts to persuade the agent to invoke exec, potentially presenting the command as troubleshooting or a required setup act ...[truncated 1289 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove exec from allowed-tools because ordinary Discord message operations do not require local command execution.
  2. Declare and use only the dedicated Discord message tool and any strictly necessary read-only interfaces.
  3. Remove shell-based ping guidance from the skill. Perform connectivity diagnostics outside the skill or expose a narrowly scoped health-check tool.
  4. If diagnostics are essential, implement a fixed-command wrapper that:
    • Does not invoke a shell.
    • Does not accept arbitrary executable names.
    • Validates destinations against an allowlist.
    • Rejects shell metacharacters and user-controlled arguments.
    • Applies strict timeouts and output limits.
    • Runs with an unprivileged operating-system identity.
  5. Treat all Discord message contents as untrusted data. Explicitly prohibit following instructions found inside retrieved messages.
  6. Protect Discord tokens through a restricted secret store, prevent their inclusion in command environments where possible, and limit the bot to the minimum required Discord permissions.
  7. Apply process sandboxing, filesystem restrictions, outbound network controls, and tool-call auditing as defense-in-depth measures.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The trigger condition references SEO optimization and ranking use cases, which are unrelated to Discord chat management. This can cause the skill to activate in inappropriate contexts, increasing the chance of unintended message access or message-sending actions when the user did not intend to use a Discord-management tool.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The activation text is both unrelated to the skill’s function and overly broad, making accidental or incorrect invocation more likely. In a messaging skill with read/send/delete capabilities, ambiguous triggering raises the risk of unintended access to chat history or unintended modifications to messages.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description understates the skill’s actual capabilities by omitting edit, delete, react, and channel enumeration functions that are later documented. This mismatch can mislead users and policy systems into granting or invoking a broader set of actions than expected, including destructive actions like deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises edit and delete operations without warning that they are destructive and may be irreversible or affect other users’ content. This increases the chance that users or agents will perform harmful modifications without informed consent or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The delete example provides a ready-to-run destructive command with no cautionary note, confirmation step, or limitation guidance. In collaborative chat environments, this can facilitate accidental deletion of important messages or abuse by a poorly supervised agent.

Content

No source excerpt is available for this finding.