Discord工具箱专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.0

Overview

This Discord administration skill is disclosed, but it combines destructive server actions with broad host tools and unclear safeguards, so it needs manual review before installation.

Install only in a tightly controlled Discord admin environment. Use a least-privilege bot token, keep moderation and role actions disabled until explicitly needed, require confirmations and dry runs for destructive or bulk actions, restrict media uploads to approved files/hosts, do not run the agent as administrator, and protect audit logs and tokens.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:34

Finding

Overprivileged Host Tools and Discord Administrative Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34-37, SKILL.md:262, SKILL.md:409, SKILL.md:420-421, and SKILL.md:453-454
Vulnerability Type: Least-privilege violation through unrestricted command execution, filesystem access, elevated host execution, and broad Discord permissions
Risk Level: High

Vulnerable Code Snippets

yaml

tools:
  - read
  - exec
  - write

The documentation also recommends broad Discord permissions, including moderation, role management, emoji and sticker management, and server management. Its generic troubleshooting guidance advises running with administrator privileges when file permissions are insufficient.

Technical Analysis

The Skill declares general-purpose read, write, and exec capabilities even though its primary function is Discord administration through the Discord API. No implementation-level command allowlist, argument validation policy, filesystem boundary, execution sandbox specification, or operation-specific authorization mapping is provided.

Broad host command execution is not necessary for most declared operations, such as sending messages, applying Discord moderation actions, or managing roles through an API. Combining exec with arbitrary filesystem reads and writes substantially expands the impact of prompt injection, malformed user input, or agent error.

The recommendation to grant the Discord bot server-management permission is similarly broader than necessary for many operations. Discord permissions should be assigned according to the enabled operation. For example, a bot that only sends scheduled messages does not require ban, kick, role-management, or server-management permissions.

Advising users to run the Agent as an administrator compounds the risk. A failure caused by insufficient access should not be resolved through blanket privilege elevation without first identifying the exact resource and minimum required permission.

...[truncated 1532 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool set unless a documented operation cannot be implemented through a constrained Discord API client.
2. Replace general command execution with narrowly scoped tool functions whose inputs are typed and validated.
3. If execution is unavoidable, use a non-shell API, a fixed executable allowlist, fixed argument schemas, a restricted working directory, strict time and resource limits, and a nonprivileged sandbox account.
4. Restrict read and write to dedicated Skill directories. Reject absolute paths, traversal, unexpected symlinks, device files, and paths outside the approved workspace.
5. Remove all recommendations to run the Agent as an administrator. Document the exact minimum ownership and filesystem permissions required instead.
6. Define a permission matrix for every Discord action and grant only the permissions needed for enabled features.
7. Do not grant server-management permission by default. Separate message, moderation, role, event, and media-management deployments where practical.
8. Keep destructive Discord operations disabled by default and require explicit, per-operation confirmation for bans, kicks, bulk deletions, and sensitive role changes.
9. Validate that the requester is authorized for the target guild, channel, member, and operation before invoking the Discord API.
10. Protect the bot token using a secret manager or environment injection, and ensure it is unavailable to unnecessary child processes.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:138

Finding

Unrestricted Local Path and Remote URL Handling for Media Uploads

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:138-157 and SKILL.md:259
Vulnerability Type: Unconstrained local file access and server-side URL retrieval
Risk Level: High

Vulnerable Code Snippets

json

{
  "action": "emojiUpload",
  "guildId": "9999999999",
  "name": "brand_celebrate",
  "mediaUrl": "file:///tmp/celebrate.png",
  "roleIds": ["222", "333"]
}

json

{
  "action": "stickerUpload",
  "guildId": "9999999999",
  "name": "brand_welcome",
  "description": "品牌欢迎贴纸",
  "tags": "👋",
  "mediaUrl": "file:///tmp/welcome.png"
}

The dependency documentation explicitly permits media to come from either a local path or a remote URL.

Technical Analysis

The Skill accepts a mediaUrl that can identify local files through the file:// scheme and also documents support for remote URLs. It does not define any mandatory path confinement, URL allowlist, network-address filtering, redirect policy, symlink policy, or content verification procedure.

If an Agent resolves arbitrary local paths, an attacker may cause it to read files outside the intended media directory. Even when Discord accepts only image-like resources, sensitive files may be disclosed if their contents are uploaded, transformed, logged, or included in an error response.

Remote URL support also creates a server-side request forgery risk if the Agent can contact loopback, private, link-local, container, or cloud metadata addresses. DNS rebinding and redirects may bypass a validation step that checks only the original URL. File extension and declared MIME type checks alone are insufficient because both can be attacker-controlled.

Attack Path

Local-file path:

1. An attacker requests an emoji or sticker upload and supplies a crafted mediaUrl using file://, an absolute path, path traversal, or a symlink located in an approved directory.
2. The Agent resolves and reads the path using its ...[truncated 1543 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer explicit file handles or previously uploaded media identifiers instead of accepting arbitrary paths or URLs.
2. Restrict local media to a dedicated, non-sensitive upload directory.
3. Canonicalize each path before access and verify that the final resolved path remains beneath the approved directory.
4. Reject path traversal, absolute paths outside the media directory, device files, named pipes, sockets, and symlinks that resolve outside the approved directory.
5. Permit only HTTPS for remote sources and use an explicit hostname allowlist where possible.
6. Resolve hostnames before connecting and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
7. Revalidate the destination after every DNS resolution and HTTP redirect. Set a low redirect limit.
8. Apply connection, read, and total timeouts as well as strict response-size limits.
9. Validate content using decoded file signatures and actual media parsing rather than relying on extensions or remote Content-Type headers.
10. Re-encode accepted images into a known-safe output format before sending them to Discord.
11. Do not include retrieved content, local paths, credentials, or internal response bodies in logs and error messages.
12. Require explicit user confirmation that identifies the final canonical local path or validated remote host before performing the upload.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation text is extremely broad, framing the skill as suitable whenever efficiency, automation, batch processing, or workflow optimization is needed. In an agent ecosystem, that can cause the skill to be invoked for generic requests unrelated to Discord, increasing the chance that powerful tools like exec, write, and Discord admin actions are selected without sufficiently specific user intent or safety gating.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly states '支持中文交互' in a way that presents Chinese interaction as the default behavior, and no alternative language choice or opt-in is described nearby. This can violate language/locale policy when a skill imposes a language preference without user selection or documented regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises bulk messaging, moderation, role changes, and resource uploads near the top, but does not present prominent upfront warnings that these are destructive or high-impact operations. In context, this is more dangerous because the skill is designed for enterprise/community administration and includes batch delete, ban, and role management capabilities that can rapidly affect many users or channels if triggered carelessly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented return schema appears to describe a generic scoring/reporting tool, not a Discord administration skill that can send messages, ban users, delete content, or modify roles. This mismatch can cause callers or wrapper agents to validate success against the wrong structure, miss destructive side effects, or fail to enforce action-specific confirmation and audit checks before executing high-impact operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Line L116 says moderation operations 'default require secondary confirmation,' implying a built-in safeguard. Later examples/configuration describe moderation being enabled directly and only certain sensitive actions being subject to forced confirmation (L303-L307, L370-L381), which creates contradictory documentation about when confirmation is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.