ClawHub
Back to skill

Security audit

Discord Master Free

Security checks across malware telemetry and agentic risk

Overview

This Discord bot helper is mostly a coherent guide, but it includes live Discord API actions with broad exec-capable permissions and limited guardrails.

Review before installing if you may let agents execute commands automatically. Use test guilds and placeholder credentials, keep bot tokens in environment variables, and require explicit confirmation before registering commands or sending messages to Discord channels.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
76% confidence
Finding
The trigger conditions are overly broad: '需要代码生成、编程辅助、调试测试、开发部署时使用' can cause the skill to activate for many unrelated software tasks. In an agent environment with `read`, `write`, and especially `exec` enabled, ambiguous activation increases the chance of the model applying Discord-specific instructions or live API actions in the wrong context, leading to unintended commands, file changes, or network operations.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill provides ready-to-run `curl` examples for registering commands and sending channel messages against live Discord APIs without an explicit warning that these are real, state-changing operations. In a tool-enabled agent, this can lead users or downstream automation to execute actions on production servers unintentionally, potentially causing spam, unauthorized bot changes, or operational disruption if real tokens and IDs are present.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.