Discord 全能控制

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.2

Overview

This Discord automation skill is not clearly malicious, but it asks for broad local host powers and supports sending local files to Discord in ways that are under-scoped for its stated purpose.

Install only if you can run it in a tightly sandboxed agent with a least-privilege Discord bot token. Do not grant broad local file, write, exec, or administrator privileges unless you independently add strict path allowlists, upload confirmation, and moderation approval workflows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:27

Finding

Excessive Host Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-30
Vulnerability Type: Excessive host permissions
Risk Level: High

Vulnerable configuration:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill requests host file-reading, file-writing, and command-execution capabilities even though its stated purpose is to interact with Discord. The documented Discord operations do not establish a legitimate requirement for unrestricted command execution or general host file modification.

If the agent platform grants these declared tools without additional sandboxing, the skill has substantially more authority than needed. In particular, exec can provide arbitrary command execution under the agent process account, while read and write can expose or modify any files accessible to that account.

The project contains only SKILL.md, so no implementation was available to demonstrate runtime restrictions, command allowlisting, path confinement, or user confirmation controls.

Attack Path

1. A user or automation environment loads the skill and grants its declared tools.
2. An attacker supplies malicious content through a prompt, Discord message, or other untrusted input processed by the agent.
3. The malicious content induces the agent to invoke read, write, or exec for a task presented as part of Discord administration.
4. The agent reads sensitive files, modifies host data, or executes commands with the privileges of the agent process.
5. Retrieved information can subsequently be transmitted through the skill's Discord messaging or upload capabilities.

Impact Assessment

Exploitation could expose credentials, configuration files, source code, and other data readable by the agent account. The write capability could modify project or user files, while exec could run arbitrary commands, alter application state, or invoke other installed programs. The scope is limited ...[truncated 158 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec and write unless a specific, documented workflow strictly requires them.
• Replace generic host tools with a dedicated Discord API tool exposing only approved Discord actions.
• If local attachment reading is necessary, provide a narrowly scoped file-selection capability rather than unrestricted read.
• Restrict readable files to an explicit upload directory and enforce canonical-path validation.
• Run the skill in a sandbox under a dedicated, unprivileged account with no access to credentials or unrelated projects.
• Require explicit user confirmation before destructive Discord actions or any operation involving local files.
• Treat Discord messages and other externally sourced text as untrusted data that must never control host-tool invocation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:49

Finding

Unrestricted Local File Upload Can Exfiltrate Host Data to Discord

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:49, 90, 103
Vulnerability Type: Unrestricted local-file disclosure channel
Risk Level: High

Relevant documented behavior, translated into English:

text

sendMessage supports mediaUrl using either a local file:/// URL or a remote https:// URL.
Media is supplied through mediaUrl, using a local file:/// path or a remote https:// URL.

Documented example:

json

{
  "action": "sendMessage",
  "to": "channel:9876543210",
  "content": "**v2.4.0 released**\n- Added poll statistics export\n- Fixed missing thread replies\nSee the attachment for complete details",
  "mediaUrl": "file:///tmp/changelog-v2.4.0.md"
}

Technical Analysis

The skill explicitly permits file:/// paths as Discord message attachments. No path allowlist, canonicalization requirement, sensitivity check, symlink defense, file ownership validation, or pre-upload confirmation is documented.

Combining local-file uploads with the declared read capability creates a direct path from the host filesystem to an external Discord destination. A malicious instruction could substitute the benign example path with a credential, configuration, environment, SSH, cloud, or source-code file accessible to the agent account.

The absence of implementation code prevents verification of whether the underlying Discord tool independently restricts local paths. The documented interface itself is unsafe because it encourages arbitrary local paths without defining security boundaries.

Attack Path

1. The skill is loaded with access to a Discord bot and the host filesystem.
2. An attacker supplies a prompt or Discord-originated instruction requesting that a local file be sent as an attachment.
3. The attacker specifies or induces a sensitive file:/// path, or points to a symlink that resolves outside an intended upload directory.
4. The agent invokes sendMessage, emojiUpload, or ...[truncated 674 chars]

Remediation

View remediation

Remediation Suggestions

• Reject arbitrary file:/// URLs.
• Restrict uploads to a dedicated, non-sensitive staging directory.
• Resolve paths to their canonical form and verify that the result remains within the approved directory.
• Reject path traversal, device files, named pipes, sockets, and symlinks that resolve outside the allowed boundary.
• Apply strict file-type and size allowlists based on validated content, not only filename extensions.
• Scan candidate files for credentials, private keys, tokens, and other sensitive content before upload.
• Display the canonical source path and exact Discord destination, then require explicit user confirmation.
• Prevent untrusted Discord messages or retrieved content from autonomously selecting local attachment paths.
• Prefer user-mediated file handles or platform-provided attachment objects over raw filesystem paths.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:236

Finding

Troubleshooting Guidance Encourages Unnecessary Administrator Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:236
Vulnerability Type: Unsafe privilege-elevation guidance
Risk Level: Medium

Relevant table entry, translated into English:

text

| Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator |

Technical Analysis

The troubleshooting guidance recommends running with administrator privileges when file access fails. This is not a safe default for a Discord automation skill, particularly because the skill also declares read, write, and exec tools.

Elevating the entire agent process expands the reach of every subsequently invoked tool. It also bypasses an important security signal: a permission failure may indicate that the requested file or operation is intentionally outside the skill's authorized scope. The recommendation does not first require identifying the specific resource, correcting narrowly scoped ownership, or granting only the minimum necessary permission.

Attack Path

1. A requested file or command fails because the unprivileged agent lacks permission.
2. The user follows the documented recommendation and restarts the agent or operation with administrator privileges.
3. The skill retains access to its declared read, write, and exec tools in the elevated session.
4. A malicious prompt, untrusted Discord message, or accidental instruction triggers a dangerous host operation.
5. The operation executes with elevated privileges and reaches files or system resources that were previously protected.

Impact Assessment

Successful abuse may permit reading or modifying administrator-only files and executing commands with elevated privileges. Depending on the operating system and elevation model, the resulting scope may include other users' data, system configuration, installed applications, protected credentials, and security controls. The guidance does not itself perf ...[truncated 76 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to run the agent or skill as an administrator.
• Treat permission failures as authorization-boundary events rather than generic operational errors.
• Identify the exact file or resource and determine whether access is genuinely required.
• Grant narrowly scoped access only to the dedicated unprivileged service account.
• Use a dedicated staging directory with controlled ownership for local attachments.
• Keep the agent sandboxed and prevent elevation during skill execution.
• Document that protected system files, credential stores, and unrelated user files must never be made accessible merely to complete a Discord action.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises a typical scenario of 'automatically executing system commands and collecting results,' while the metadata also declares the 'exec' tool. That combination can mislead an agent or operator into using local command execution outside the intended Discord-control boundary, expanding the attack surface to arbitrary code execution, local data access, and host compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The document describes destructive moderation actions such as timeout, kick, and ban with operational detail, but does not place a prominent user-facing confirmation or authorization warning immediately around their use. In an agent-executed context, this increases the risk of accidental or unauthorized disciplinary actions against Discord users, causing service disruption and governance abuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L221 的安全风险防范写明“仅执行白名单命令，避免拼接用户输入”，这表明存在命令执行语义；但全文能力清单均围绕 Discord API 操作，并未声明任何可供用户触发的白名单命令体系。该注释式文档与技能实际宣称用途不一致，属于文档意图与所述功能的主动性偏离。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L252 将“数据提取：从非结构化文件中提取关键信息并结构化输出”列为典型场景，但前文功能仅涉及 Discord 资源管理与交互，并未描述文件解析或信息抽取引擎。该场景文案与技能的已声明功能方向明显不一致。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The example demonstrates deleting a message as part of a moderation workflow without clearly warning that content removal is destructive and may affect evidence retention, user trust, or auditability. In an automated agent setting, examples strongly shape behavior, so omission of a caution can normalize unsafe deletion practices.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.