Discord社区免费

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a read-only Discord helper, but it requests local command execution and file-write authority that its documented workflow does not justify.

Review before installing. The Discord lookup behavior itself is understandable, but install it only in an environment that can restrict the skill to the Discord/ClawLink read-only tools it actually needs, and avoid granting general exec or write access unless the publisher explains a specific need. Be aware that returned Discord data can include personal profile fields, email if authorized, OIDC claims, and guild membership information.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:33

Finding

Unnecessary Shell Execution and Filesystem Write Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:33-36
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares access to the exec and write tools even though its documented purpose is limited to read-only Discord queries. Its described workflow only requires ClawLink integration discovery and Discord API query operations.

Shell execution and filesystem modification are substantially more privileged than the skill's legitimate functionality requires. Their availability expands the consequences of prompt injection, malicious user input, untrusted integration output, or erroneous agent behavior. This is a least-privilege violation rather than evidence that the current skill deliberately executes commands or modifies files.

Attack Path

1. An agent loads the skill and grants all tools declared in its metadata, including exec and write.
2. The agent processes attacker-controlled input or untrusted content returned by an external integration.
3. The content manipulates the agent into invoking one of the unnecessarily available privileged tools.
4. The exec tool runs a local command, or the write tool creates or modifies a local file.
5. The resulting effect occurs with the operating-system permissions and filesystem access of the agent process.

No command payload or direct invocation of these tools was found in the audited file. Exploitation therefore depends on a separate instruction-manipulation or tool-misuse condition.

Impact Assessment

Successful exploitation could allow command execution and file modification within the privileges of the hosting agent process. Depending on the environment, this could affect project files, accessible configuration, local data, or other resources available to that process.

The affected scope is broader than the skill's stated read- ...[truncated 215 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary exec and write entries from the skill metadata.
2. Grant only the narrowly scoped ClawLink and Discord read-only tools needed for documented operations.
3. Enforce an explicit allowlist for tools such as integration discovery, authorization inspection, user lookup, guild lookup, invite resolution, gateway lookup, and public-key retrieval.
4. If filesystem writes later become necessary, document the exact use case and restrict writes to a dedicated directory with minimal permissions.
5. If command execution later becomes necessary, expose a narrowly scoped operation instead of a general-purpose shell and validate all arguments against a strict allowlist.
6. Treat user input and external integration responses as untrusted data, and prevent either from authorizing tool use or overriding tool restrictions.
7. Add an automated manifest check that rejects privileged tool declarations not exercised by and justified in the documented workflow.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The display name, summary, and the full skill instructions are written in Chinese, and the file does not indicate that language selection is optional or user-configurable. That creates a natural-language policy concern because the skill effectively forces a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly asserts that all actions are 'safe' and read-only, yet the manifest declares both exec and write capabilities. This mismatch is dangerous because users or the hosting agent may trust the documentation and permit execution in contexts where broader side effects are technically possible, enabling abuse through capability confusion or later prompt/tool misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill handles sensitive personal data including profile information, guild membership, email, and OIDC claims, but it does not provide a clear privacy warning, consent boundary, or data-handling limitations. This increases the risk of inadvertent collection, display, logging, or downstream reuse of personal data without adequate user awareness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.