ClawHub
Back to skill

Security audit

Discord 基础控制

Security checks for vulnerabilities and agentic risk

Overview

The skill is for Discord bot control, but it grants broad local command and file-write authority while also enabling message reading, deletion, posting, pinning, and local archiving without clear consent or retention controls.

Install only if you are comfortable giving the agent broad local command/file authority and Discord message-management authority. Before use, restrict the bot token and Discord permissions to specific servers/channels, require explicit approval before deleting or archiving messages, and decide where any local archives live and how they will be removed.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill is presented as a narrowly scoped Discord control capability, but the manifest grants broad `exec` and `write` tools that can operate outside Discord and exceed the documented free-skill limitations. This creates a privilege/scope mismatch: if the agent follows the skill literally, an attacker or prompt injection could leverage those general-purpose capabilities for arbitrary local command execution or file modification unrelated to Discord tasks.

Context-Inappropriate Capability

Low
Confidence
75% confidence
Finding
Declaring a `callback_url` introduces an outbound network sink that is not justified by the core Discord bot control use case described in the skill. If honored by an agent or implementation, it could be abused to exfiltrate message contents, identifiers, or execution results to attacker-controlled endpoints under the guise of asynchronous completion handling.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly supports reading, deleting, pinning, and archiving Discord messages but does not provide clear privacy and retention warnings to the user. In a communications context, these operations can expose or persist potentially sensitive server content, and the lack of notice increases the risk of improper collection, storage, or destructive actions without informed consent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The example workflow instructs the agent to retrieve recent Discord messages and write extracted fields to a local archive file without any warning about storing retrieved content. This normalizes persistence of potentially sensitive communications to disk, increasing the risk of unintended retention, local exposure, or later misuse of archived chat data.

Static analysis

No suspicious patterns detected.