ClawHub
Back to skill

Security audit

Discord Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Discord automation helper, but it asks for broad local execution and file access while also enabling message deletion, history search, DMs, and local-file uploads without tight safeguards.

Review before installing. Use this only with a least-privilege Discord bot, restrict channels and message-management permissions, avoid using it with sensitive local files, and require explicit confirmation before delete/edit, DM, search, or local-file upload actions. The skill should not need broad shell execution for ordinary Discord messaging.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:5
Finding

Overprivileged Shell Execution Capability

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: High

Vulnerable configuration:

yaml
allowed-tools: read exec

Technical Analysis

The skill declares access to the unrestricted exec tool even though its documented functionality consists of Discord message and interaction management. No packaged scripts or specific local commands require shell execution.

Granting general shell execution exceeds the skill's stated operational requirements. If untrusted message content, parameters, or prompt-injected instructions influence tool selection, the agent could execute arbitrary commands with the privileges of its operating-system account. The separate read permission also increases the potential impact by allowing local information to be collected before it is processed or transmitted.

The Markdown file does not define a command allowlist, argument validation, execution sandbox, working-directory restriction, or confirmation requirement for shell operations.

Attack Path

  1. A user or attacker supplies crafted input while requesting a Discord-related operation.
  2. The input instructs or prompt-injects the agent to use exec as part of processing the request.
  3. Because exec is explicitly authorized by the skill, the agent runs an attacker-influenced command.
  4. The command accesses files, environment variables, credentials, network resources, or other processes available to the agent account.
  5. Retrieved information may subsequently be returned to the requester or transmitted through the skill's Discord messaging functionality.

This path requires the hosting agent to permit skill-level tool authorization to result in shell execution and to insufficiently isolate untrusted input.

Impact Assessment

Successful exploitation could provide command execution under the agent's operating-syst ...[truncated 521 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove exec from allowed-tools; Discord API operations should use only the dedicated Discord integration.
  • Remove read unless a narrowly defined feature genuinely requires local file access.
  • If local command execution is unavoidable, replace unrestricted exec with a constrained wrapper that exposes an allowlist of fixed commands and validated arguments.
  • Run the wrapper in a sandbox with a dedicated low-privilege account, read-only filesystem access, restricted environment variables, no shell interpolation, and deny-by-default network controls.
  • Never construct commands from message text, filenames, channel content, or other untrusted values.
  • Require explicit user confirmation before any operation accesses local resources.
  • Add platform-level policy enforcement so Markdown instructions cannot independently authorize unrestricted shell execution.
  • Record and review all attempted command executions, including command identity, validated arguments, requesting user, and destination.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:160
Finding

Unrestricted Local File Upload Through mediaUrl

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 160-171
Vulnerability Type: Missing access controls for local-file disclosure
Risk Level: High

Vulnerable parameter example:

json
"mediaUrl": "file:///tmp/build-result.png"

The accompanying documentation states that mediaUrl supports local files through file:///path/to/file paths as well as remote URLs.

Technical Analysis

The skill permits a Discord message operation to consume a caller-selected local file path. It does not specify a permitted directory, path canonicalization, file-type validation, symbolic-link handling, sensitive-file denylist, ownership check, or explicit authorization step.

If the underlying Discord tool resolves arbitrary file:// paths as documented, the feature crosses the boundary between Discord messaging and local filesystem access. An attacker who can influence mediaUrl could attempt to upload any file readable by the agent process rather than only user-approved media artifacts.

The risk is amplified by the skill's declared read permission and its use of an external Discord destination. File-size limits do not provide meaningful protection against disclosure of credentials, configuration files, source code, logs, or other small sensitive files.

Attack Path

  1. The attacker identifies or guesses a sensitive path readable by the agent account.
  2. The attacker requests a Discord message with mediaUrl set to a crafted file:// URI referencing that path.
  3. The Discord integration opens the local file while preparing the attachment.
  4. The bot uploads the file to an attacker-accessible Discord channel or direct-message destination.
  5. The attacker downloads the attachment and obtains the disclosed local data.

Alternative path-manipulation techniques may include relative-path normalization, encoded path components, or symbolic links if the implementation converts the URI without canonicalization. ...[truncated 565 chars]

Remediation
View remediation

Remediation Suggestions

  • Disable file:// support by default and accept only files explicitly supplied through a trusted attachment interface.
  • If local uploads are required, restrict access to a dedicated export directory containing only user-approved artifacts.
  • Canonicalize each requested path before authorization and verify that the resolved path remains beneath the approved directory.
  • Reject relative paths, path traversal, device files, named pipes, sockets, symbolic links, and hard links to content outside the approved directory.
  • Apply file-type, extension, MIME-type, and size allowlists, while recognizing that these checks supplement rather than replace path authorization.
  • Require explicit confirmation showing the resolved local path, destination channel or user, file size, and attachment name before upload.
  • Run attachment processing under a dedicated account with no access to credentials, home directories, source repositories, or secret mounts.
  • Redact local paths from ordinary logs and maintain security audit records for approved file transfers.
  • Add automated tests covering traversal, URI encoding, symbolic-link escape, sensitive paths, and unauthorized Discord destinations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill's trigger conditions are overly broad and mismatched, claiming it should be used for code generation, debugging, testing, and deployment even though the skill operates on Discord actions. In an agent ecosystem, ambiguous or overbroad activation can cause the skill to be invoked in unrelated contexts, leading to unintended message sending, deletion, searches, or private messaging with the bot's existing permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

该技能的名称说明、使用说明、示例与问答均以中文固定呈现，未向用户提供语言或本地化选择，也未说明这是特定地区或合规要求下的限定。按照语言/locale 政策，强制单一语言而无用户选择可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill enables sensitive operations including deleting or editing messages, sending DMs, and searching message history, but it does not present explicit safety boundaries, consent requirements, or privacy warnings. In the context of a Discord bot with real channel permissions, this increases the risk of unauthorized moderation-like actions, privacy violations, or accidental access to historical content beyond user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

L134 的“需要代码生成、编程辅助、调试测试、开发部署时使用”明显描述的是通用开发类技能，而本文件其余部分和 manifest 都将该 skill 定义为 Discord 消息与互动管理工具。这不是简单信息缺失，而是文档对技能意图的直接错误表述，容易误导调用方在不相关场景下使用该技能。

Content

No source excerpt is available for this finding.