Security audit

Discord语音免费

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a Discord voice assistant, but it can capture and process speech from anyone in a joined voice channel without a clear consent or user-scope control.

Install only for private or clearly announced Discord voice channels where participants know speech may be processed. Treat DISCORD_TOKEN and OPENAI_API_KEY as sensitive credentials, and avoid running the unpinned global npm install unless you understand and accept the supply-chain risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:199
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Pin `node-gyp` and all transitive dependencies through `package.json` and a committed lockfile such as `package-lock.json`. 3. Use reproducible installation after a lockfile has been reviewed: ```bash npm ci ``` 4. Verify that npm uses the expected official registry: ```bash npm config get registry ``` 5. Where practical, enforce package integrity and provenance verification and disable unnecessary lifecycle scripts during dependency retrieval: ```bash npm ci --ignore-scripts ``` Any required build scripts should then be reviewed and invoked explicitly. 6. Do not run npm installation commands with administrator or root privileges. 7. Replace the troubleshooting instruction with a documented, version-pinned setup procedure and periodically review the selected package version and dependency graph for known vulnerabilities. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Lines L066-L067 state the free version '仅支持本地 Whisper STT,无需外部 API Key', which conveys a no-external-key expectation for the free offering. However, the same file later documents OpenAI TTS as a core capability and explicitly requires OPENAI_API_KEY at L118, L130, and L202, contradicting the earlier intent-level documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly states that it does not support an allowedUsers whitelist and that all users can trigger it, yet it does not prominently warn that voice from anyone in the channel may be captured, transcribed, and processed. In a Discord voice context, this creates a real privacy and consent risk because bystanders or non-consenting participants may have their speech recorded and sent through STT/TTS workflows.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: L070-L071 says the free version '仅支持默认配置' with fixed values and that advanced options cannot be adjusted. Immediately after, L069 and L073 tell users to consult configuration docs for parameter tuning, which contradicts the stated immutability of the free version's settings.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.