Discord语音工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.2

Overview

This Discord voice skill is not clearly malicious, but it needs Review because it is loosely scoped, processes live voice conversations, and gives unverifiable installation guidance.

Install only after confirming the official repository/package source, pinning versions or checksums for dependencies and models, running the bot under a limited account, protecting DISCORD_TOKEN and any cloud API keys, and getting clear consent from Discord voice-channel participants before recording or transcribing speech.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:150

Finding

Unpinned and Unverifiable Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:150-156, SKILL.md:284-285, and SKILL.md:335-342
Vulnerability Type: Supply-chain exposure through unpinned packages, native modules, repositories, and model downloads
Risk Level: Medium

Vulnerable Code

SKILL.md:150-156:

bash

# Install through the platform
platform install discord-voice

# Or install manually
cd $HOME/.agent/extensions
git clone <repository-url> discord-voice
cd discord-voice
npm install

SKILL.md:284-285:

bash

npm install -g node-gyp
npm rebuild @discordjs/opus sodium-native

SKILL.md:335-342:

text

| Local Whisper model | Model | Required | Automatically downloaded on first run |
| Kokoro TTS model | Model | Required | Automatically downloaded on first run |
| Node.js native modules | Library | Required | Compiled by npm install |

- Discord Bot Token: Configured through the DISCORD_TOKEN environment variable.
- Local models: Free Whisper and Kokoro models are automatically downloaded on first run without an API key.

Technical Analysis

The skill instructs users or Agents to install executable third-party components without specifying exact package versions, immutable repository commit hashes, lockfile enforcement, source authenticity requirements, or integrity hashes.

The manual installation command contains an unresolved repository placeholder, so the source cannot be verified from the audited package. The platform package identity and version are also unspecified. In addition, npm install may execute dependency lifecycle scripts, while rebuilding @discordjs/opus and sodium-native compiles and loads native code. A global installation of node-gyp expands the effect beyond an isolated project environment.

Whisper and Kokoro models are described as automatically downloaded, but the document does not identify their download locations, versions, signatures, or expec ...[truncated 2065 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the repository placeholder with the official HTTPS repository and document its expected owner and canonical URL.
2. Pin the plugin to an immutable release artifact or commit hash rather than installing an unspecified current version.
3. Pin exact npm dependency versions and include a reviewed lockfile. Use npm ci instead of unrestricted npm install.
4. Publish and verify cryptographic checksums or signatures for plugin releases, native binaries, and model files.
5. Specify exact Whisper and Kokoro model versions, canonical download origins, expected file sizes, and SHA-256 hashes.
6. Avoid global npm installation. Install build tools in a constrained project environment or a disposable build container.
7. Use npm ci --ignore-scripts during initial verification where feasible. Audit every lifecycle script before explicitly allowing required build steps.
8. Build native dependencies in a sandbox with restricted filesystem access, no unnecessary credentials, and limited outbound network access.
9. Run the Discord plugin under a dedicated, non-administrative account with access only to required configuration and data.
10. Ensure installation and build environments do not expose DISCORD_TOKEN or unrelated Agent secrets.
11. Add automated dependency scanning, lockfile validation, provenance verification, and reproducible release procedures.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition is so broad that the skill may activate for many unrelated requests involving AI models, orchestration, or LLM applications. In an agent ecosystem with exec/write access, overbroad matching increases the chance the skill is invoked outside its intended Discord voice context, leading to unnecessary command execution, installation steps, or collection/processing of audio-related data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The description states '支持中文交互' as a capability, which may impose a language expectation without indicating whether other languages are supported or whether the user can choose their preferred language. Under the policy, forcing or implicitly constraining language/locale without opt-in can be a violation unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes automatic voice activity detection and speech processing in Discord channels without a clear up-front warning that participants' speech may be monitored, transcribed, and synthesized. In a live voice-channel context, inadequate notice can lead to covert or unexpected collection of user communications, creating privacy and consent risk even if processing is local.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The overview states the free version '聚焦本地离线方案' and '不依赖任何付费云 API', framing the skill as an offline/local-only voice tool. However later sections explicitly say users can switch to OpenAI/Deepgram/ElevenLabs by supplying API keys, which directly contradicts the stated intent of the free edition's scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The capability table marks '多服务商' as unsupported in the free edition, implying the free tool does not offer provider switching. Later FAQ/API-key sections tell users they can configure OpenAI, Deepgram, and ElevenLabs in this version, which conflicts with the earlier declared product behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The offline-use section explicitly says audio is processed locally and '无需任何 API Key'. Later, the known limitations state '需要API Key，无Key环境无法使用', which is a direct contradiction about whether credentials are required for the skill to function.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

bash

# Ubuntu / Debian
sudo apt-get install ffmpeg build-essential python3

# CentOS / RHEL
sudo dnf install ffmpeg gcc-c++ make python3

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

sudo apt-get install ffmpeg build-essential python3

# CentOS / RHEL
sudo dnf install ffmpeg gcc-c++ make python3

# macOS
brew install ffmpeg

Static analysis

No suspicious patterns detected.