ClawHub
Back to skill

Security audit

Discord语音助手

Security checks for vulnerabilities and agentic risk

Overview

This Discord voice skill is mostly purpose-aligned, but it handles live voice and external transcription/speech services without clear consent, retention, or access boundaries.

Review this before installing in any real Discord server. Require explicit participant notice/consent, restrict allowed users/channels, prefer local providers where possible, disable any archive/callback behavior unless needed, and verify where audio and transcripts are sent or stored.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill captures live voice, may stream it to external STT/TTS providers, and discusses transcripts and callbacks, but it does not prominently require informed consent, disclose third-party data transfer, or define retention boundaries. In a Discord voice context this can expose sensitive conversations, personal data, and bystander speech to external services without adequate warning or policy controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description says the skill should be used when handling '视频处理、音频编辑、媒体转换、配音生成', which is far broader than the skill's actual Discord voice-channel function. This ambiguous trigger scope could cause the skill to be invoked for generic media tasks unrelated to Discord voice interaction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description explicitly states '支持中文交互' as a behavioral constraint, but does not indicate that other languages are supported by user choice. This is a natural-language locale policy issue because it prescribes a specific language without opt-in or justification as a region-specific tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The '专业版专属特性' section says the skill supports '通信记录归档与检索' as a premium feature, implying retention and retrieval of communication data. Later, the notes explicitly state '不支持语音消息存档与回放', which contradicts that earlier capability claim rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

At L113-L115 the skill is classified as 'MD+EXEC', indicating executable capability. At L403-L405 it is reclassified as 'MD（纯Markdown指令，通过自然语言驱动Agent完成操作）', which directly contradicts the earlier classification and changes the implied execution model.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The API key section says the skill is based on the agent platform's built-in LLM and '通常无需额外API Key配置'. However, the same document explicitly requires DISCORD_TOKEN and provider keys such as OPENAI_API_KEY, DEEPGRAM_API_KEY, and ELEVENLABS_API_KEY for core voice features, making the statement misleading and inconsistent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.