Security audit
Security checks for vulnerabilities and agentic risk
The skill is a Discord messaging helper, but it includes broad posting, deletion, and message-archiving patterns without enough scoping or confirmation guidance.
Review this skill before installing. Use it only with a Discord bot that has the minimum channel and moderation permissions needed, require human confirmation before sending, editing, deleting, or bulk-exporting messages, and avoid archiving private channel content unless users have approved the retention location and duration.
The activation language is overly broad, covering generic communication and notification use cases far beyond narrowly scoped Discord chat actions. Broad triggering criteria can cause an agent to invoke the skill in unintended contexts, increasing the chance of sending messages, notifications, or communications without sufficient user confirmation or destination validation.
The documentation includes destructive deletion and local data-writing workflows without strong warnings, consent requirements, or confirmation steps. In an agent setting, this can normalize actions that delete messages or write retrieved content to disk, leading to accidental data loss or unintended persistence of sensitive communications.
Archiving retrieved Discord messages into a local file introduces a clear data retention risk because channel content may contain sensitive or private information. Persisting that data locally expands exposure surface, bypasses platform retention expectations, and can leak information if the host or filesystem is later accessed.
The example explicitly instructs bulk extraction of messages by author and writing them to a local archive file, which operationalizes collection and retention of potentially sensitive communications. In context, this makes misuse easier by providing a ready-made pattern for mass data export from Discord into less-governed local storage.
No suspicious patterns detected.
