ClawHub
Back to skill

Security audit

Discord Master Free

Security checks for vulnerabilities and agentic risk

Overview

This is a Discord bot development guide whose Discord API examples and token use are disclosed and aligned with its stated purpose.

Install this only if you want an agent to help with Discord bot development. Treat any Discord API POST, command registration, message sending, moderation action, or token-bearing curl command as a real action against your Discord app or server; review the exact request and use a test guild first.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

L005-L006 及全文内容均以中文固定呈现，且未说明可根据用户偏好切换语言。对于面向广泛 Agent 平台的技能，这种默认强制单一语言而无用户选择，符合语言/locale 约束未获用户 opt-in 的政策问题。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented curl command performs an authenticated POST to Discord using the bot token, which is an external transmission and state-changing action. In this skill's context, such behavior is expected for Discord bot administration, but because the skill declares exec capability and provides ready-to-run commands, it becomes dangerous if an agent executes them without explicit approval or with attacker-controlled parameters.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# 注册全局命令（所有服务器可用，缓存最长1小时生效）
curl -X POST \
  -H "Authorization: Bot $DISCORD_BOT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill includes concrete examples that perform write actions against external systems, such as sending Discord messages and registering commands, but it does not prominently require explicit user confirmation before executing those actions. In an agent context with exec capability, this increases the risk of unintended outbound API calls, server-side changes, or spam if the agent operationalizes the examples automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L165-L167 将触发条件描述为“需要代码生成、编程辅助、调试测试、开发部署时使用”，覆盖面非常广，几乎适用于大量日常开发类请求，而不仅限于 Discord Bot 开发。该描述虽有“不适用于非本工具能力范围”的补充，但没有给出明确触发短语、边界条件或负例，容易导致误触发。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

L296 says real-time Gateway event handling is only provided in the pro version. Yet L145-L155 describes use cases based on GUILD_MEMBER_ADD and message-event monitoring, and L260-L262 explains how to enable Message Content Intent for listening to message content, creating a contradictory picture of whether Gateway-event guidance is included in the free edition.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L298 states that message components such as buttons, select menus, and modals are only available in the professional edition. However, L103-L123 documents interaction responses including component-driven message updates (type 7) and modals (type 9), which directly contradicts that limitation statement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.