Security audit

discord admin

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Discord administration skill, but it gives an agent broad server-changing power with little built-in safety control.

Install only if you intentionally want an agent to administer a Discord server. Use a dedicated least-privilege bot limited to the intended guild, avoid passing the token on the command line, keep the token out of logs and shared shells, and manually review any delete, ban, kick, webhook, role, guild-setting, or bulk command before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises extensive shell-driven administrative control over Discord but does not declare permissions or otherwise warn that it can perform sensitive actions. That omission can mislead users and any permission-review layer about the real capability of the skill, increasing the chance of unsafe use or over-trust.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documentation normalizes destructive operations such as channel deletion, pruning, bans, webhook control, and guild transfer without prominent cautionary guidance or guardrails. In an agent context, this materially increases the risk of accidental or socially engineered execution of irreversible or privacy-impacting actions against a live Discord server.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to export a Discord bot token but provides no security guidance about secret handling, storage, rotation, or exposure risks. Since bot tokens grant powerful server administration capabilities, careless handling can lead to full compromise of Discord servers managed by the bot.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: This script exposes high-impact destructive operations such as deleting channels, deleting roles, kicking, banning, pruning, and bulk deletion with no interactive confirmation, dry-run, or safety guardrails. In a full-server-admin skill, that increases the chance of accidental or coerced misuse and can rapidly cause irreversible integrity damage across a Discord server.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script exposes destructive administrative operations such as channel deletion, role deletion, kicking, banning, and message deletion with no confirmation, dry-run mode, or guardrails. In a high-privilege Discord administration context, a mistaken invocation or automated misuse can immediately cause irreversible service disruption, moderation abuse, or loss of server content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.