ClawHub
Back to skill

Security audit

Discord Voice Tool Free

Security checks across malware telemetry and agentic risk

Overview

This Discord voice skill is coherent for its stated purpose, but it needs review because it can record and transcribe voice-channel audio and use a Discord bot token without enough consent and secret-handling guidance.

Review before installing. Use this only in Discord channels where participants know audio may be recorded and transcribed, configure allowedUsers instead of leaving access open on shared servers, keep DISCORD_TOKEN only in a private environment variable or secret manager, and avoid sharing logs or screenshots that may expose credentials or voice transcripts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
84% confidence
Finding
The trigger condition is so broad that the skill could activate for many generic AI, orchestration, or conversation requests unrelated to Discord voice. In an agentic environment with exec capability, overbroad matching increases the chance of unintended tool invocation, causing unexpected joins to voice channels, credential use, or execution of setup commands outside user intent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill describes automatic voice activity detection, recording, transcription, and spoken response generation without a prominent privacy warning or consent guidance for channel participants. In a multi-user Discord context, this can lead to covert or poorly disclosed collection of voice content, creating privacy, policy, and possibly legal exposure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs users to configure a Discord bot token but does not clearly warn that it is a sensitive secret that must not be exposed in logs, repositories, screenshots, or chat transcripts. Mishandling the token could allow attackers to take over the bot, access connected servers within granted permissions, and abuse voice or messaging capabilities.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.