Security audit

Discord中心

Security checks across malware telemetry and agentic risk

Overview

This Discord skill asks for broad local read, execute, and write authority without clear limits, even though its stated purpose is mainly Discord bot workflows.

Install only if you are comfortable granting this skill host-level read, command execution, and file-writing capabilities for Discord-related work. Prefer using it in a constrained workspace, with a narrowly scoped Discord token, and require explicit confirmation before it sends messages, runs commands, or changes files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill is presented as a Discord Bot API workflow, but the body also describes generic command execution, file handling, and broad automation scenarios. This mismatch can cause users or calling agents to invoke a much more powerful capability set than expected, increasing the chance of unsafe execution under a misleading trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest advertises a Discord integration skill while declaring read, exec, and write tools, which grants broad local-system access not implied by an API workflow description. This discrepancy is dangerous because downstream agents may treat the skill as a narrow integration while actually handing it powerful host-level capabilities.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Unrestricted exec is a high-risk capability and is not justified by the stated purpose of Discord Bot API workflows. If an agent follows the skill literally, it could run arbitrary shell commands on the host, enabling command injection, data exfiltration, environment tampering, or destructive system actions.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Write access to the local filesystem exceeds what users would reasonably expect from a Discord messaging/API skill. In the presence of agent autonomy, this can be used to alter files, plant scripts, overwrite configs, or stage persistence-related artifacts without clear user awareness.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation language is overly broad, inviting use for generic efficiency, automation, and workflow optimization rather than a narrow Discord-specific purpose. In a tool-selection context, this increases the chance the skill is chosen in inappropriate situations, exposing read/exec/write capabilities more often than intended.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation discusses command execution and operational failure modes but does not give a prominent upfront warning that the skill may affect the local system or external messaging targets. That omission can mislead users and agents into authorizing actions with real system or communication impact without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.