ClawHub
Back to skill

Security audit

discord admin

Security checks for vulnerabilities and agentic risk

Overview

This Discord admin skill is broadly purpose-aligned, but it can make powerful live server changes with weak safeguards and weak credential handling.

Install only if you are comfortable giving a script broad Discord bot authority. Use a least-privilege bot rather than ADMINISTRATOR, keep tokens out of command lines and logs, review every destructive command before running it, and avoid using bulk moderation or webhook-management commands until safeguards and redaction are added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
discord-admin.sh:257
Finding

Unescaped User Input Permits Discord API JSON Payload Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
discord-admin.sh:231
Finding

Discord Bot Token Can Be Exposed Through Process Arguments and Shell History

Content
View full analysis
Bot token (or set DISCORD_BOT_TOKEN) ``` ### Technical Analysis Secrets supplied as command-line arguments can be exposed through: - Process listings and process-monitoring tools. - Process accounting and telemetry. - Shell history. - CI/CD command logs. - Debug traces and wrapper-script logging. - Agent execution transcripts. The implemented `--token` parser in `discord-admin.sh` only processes global options before the command name, while the example places the option after the command arguments. The example is therefore operationally inconsistent, but it still encourages placing a sensitive bot credential in command text. `discord-ctrl.sh` advertises `--token` but does not implement parsing for it. This inconsistency may cause operators to retry commands or expose credentials in logs while troubleshooting. ### Attack Path 1. An administrator or Agent invokes the CLI with `--token` and the Discord bot token. 2. The complete command is stored in shell history, Agent logs, CI logs, telemetry, or temporarily exposed in the process argument list. 3. A local user, log reader, monitoring service, or other party with access to those records obtains the token. 4. The party sends requests directly to Discord's API us ...[truncated 928 chars]
Remediation
View remediation
&2 ``` 5. Never echo the token or include it in debug output, error messages, telemetry, or API response logs. 6. Mask the token in CI/CD systems and Agent execution records. 7. Document token rotation and revocation procedures. 8. Correct or remove the unsupported `--token` documentation in `discord-ctrl.sh`. 9. Assign the bot only the minimum Discord permissions needed for the intended operation rather than routinely granting `ADMINISTRATOR`. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
discord-admin.sh:331
Finding

Raw Webhook API Responses May Disclose Reusable Webhook Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code is clearly related to Discord server administration, so the general domain matches the description. However, the declared purpose significantly overstates the implemented functionality. The script only exposes a narrow subset of Discord admin actions: channel, role, and limited member management, message send/delete, server info, and emoji listing. It does not implement several prominently declared areas such as AutoMod, webhooks, templates, audit logs, scheduled events, or threads, and therefore does not constitute 'complete A-Z' or 'full server control.' There are no obvious unrelated or undeclared harmful capabilities beyond the stated Discord administration domain, but the description is materially broader than the actual behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Mass-ban, mass-kick, and mass-role operations enable rapid, large-scale changes to membership and permissions, yet they are documented without explicit caution, approval requirements, or verification steps. In the context of full server administration, this materially raises the risk of catastrophic misuse, whether accidental or prompted by malicious input.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script exposes high-impact destructive actions such as bans, kicks, channel/role deletion, bulk message deletion, guild edits, and leaving a guild with no confirmation, dry-run, or safety interlock. In an agentic or automation context, a mistaken command, prompt injection, or argument mix-up can immediately cause irreversible administrative damage to a Discord server.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises extensive shell-driven administrative capabilities but does not declare any tool scope such as allowed tools or permissions. In an agent environment, that omission weakens guardrails and can allow broad shell execution for highly privileged server-management actions without explicit sandboxing or approval boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation prominently exposes destructive administrative actions such as deletion, bans, transfer, and bulk operations without clear safety warnings, preconditions, or approval prompts. In a skill intended for agent use, this increases the chance of accidental or unauthorized destructive execution against a live Discord server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The quick-start instructs users to export a Discord bot token without any warning about secrecy, storage hygiene, or avoiding command-history leaks. Because the token grants administrative API access, mishandling it can lead to full bot compromise and broad server abuse.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · discord-admin.sh (reported line 27)May include surrounding context.

sh
# Check deps
check_deps() {
    command -v curl &> /dev/null || { log_error "curl required"; }
    command -v jq &> /dev/null || { log_error "jq required (sudo apt install jq)"; }
}

validate_token() { [[ -z "$BOT_TOKEN" ]] && log_error "DISCORD_BOT_TOKEN not set"; }

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · discord-admin.sh (reported line 35)May include surrounding context.

sh
# API wrapper
api() {
    local method=$1 endpoint=$2 data=$3
    local response=$(curl -s -w "\n%{http_code}" -X "$method" \
        "$API_BASE$endpoint" \
        -H "Authorization: Bot $BOT_TOKEN" \
        -H "Content-Type: application/json" \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The help text claims stage-create, stage-edit, and stage-close manage Discord stage instances. However, the implementation uses /channels/.../threads for creation and generic channel patch/archive operations, which corresponds to thread/channel manipulation rather than stage-instance lifecycle management.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The help output says template-use <code> <name> should create a server from a template, implying use of a template code. The code instead calls POST /guilds/$1/templates, treating the first argument as a guild ID and interacting with guild template management rather than server creation from a template.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises broad capabilities including AutoMod, webhooks, templates, audit logs, scheduled events, threads, and full server control via CLI. The help text and implemented commands only cover basic channel, role, member, message, server info, and emoji operations, so the described behavior materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The wrapper exposes destructive actions such as channel deletion, role deletion, kicks, and bans without any confirmation prompt, dry-run mode, or guardrail. In a server-administration skill, this increases the risk of accidental or scripted misuse that can immediately disrupt community operations and moderation state.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · discord-ctrl.sh (reported line 61)May include surrounding context.

sh
local endpoint="$2"
    local data="$3"
    
    curl -s -X "$method" \
        "https://discord.com/api/v10$endpoint" \
        -H "Authorization: Bot $BOT_TOKEN" \
        -H "Content-Type: application/json" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The webhook example embed uses the string "内容", which introduces a specific non-English locale in a generic administration skill without any language-choice context. This can conflict with organizational language/locale policies when the skill does not offer user opt-in or explain locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.