ClawHub
Back to skill

Security audit

discord admin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a Discord administration CLI with real destructive server powers, but it lacks safety confirmations and handles bot credentials in ways that can expose them locally.

Install only if you are comfortable giving a shell script broad Discord bot authority. Use a least-privileged bot, avoid the --token option, run it only on a trusted machine with restricted process visibility, and manually review destructive commands before use because the scripts do not require confirmation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
discord-admin.sh:33
Finding

Discord bot token exposed through process command-line arguments in discord-admin.sh

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
discord-ctrl.sh:56
Finding

Discord bot token exposed through curl process arguments in discord-ctrl.sh

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior materially expands beyond the declared description, including message manipulation and other high-impact moderation actions. This mismatch undermines trust and reviewability, increasing the chance that operators grant the skill access for 'server administration' while overlooking broader capabilities that can alter content, remove evidence, or impersonate workflow-approved actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior materially expands beyond the declared description, including message manipulation and other high-impact moderation actions. This mismatch undermines trust and reviewability, increasing the chance that operators grant the skill access for 'server administration' while overlooking broader capabilities that can alter content, remove evidence, or impersonate workflow-approved actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text explicitly documents stage-create, stage-edit, and stage-close as stage instance operations. In code, stage-create posts to /channels/$1/threads with type:13, and stage-close patches a channel with {"archived":true}, which are thread semantics rather than stage-instance management. This is an active contradiction between documentation and behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents shell-based administration capabilities but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, missing scope declarations can cause overbroad shell access and make it easier for downstream prompts or users to invoke powerful administrative actions without clear containment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to export a Discord bot token but provides no warning about secrecy, least privilege, storage hygiene, or rotation. Because this token likely grants broad server administration powers, disclosure through shell history, logs, screenshots, or shared environments could lead to full compromise of Discord servers managed by the bot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation normalizes destructive administrative operations such as channel deletion, pruning, bans, and bulk actions without any warning, dry-run guidance, or confirmation pattern. In the context of a full-power Discord admin skill, this meaningfully increases the risk of accidental or socially engineered destructive actions against real communities.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · discord-admin.sh (reported line 27)May include surrounding context.

sh
# Check deps
check_deps() {
    command -v curl &> /dev/null || { log_error "curl required"; }
    command -v jq &> /dev/null || { log_error "jq required (sudo apt install jq)"; }
}

validate_token() { [[ -z "$BOT_TOKEN" ]] && log_error "DISCORD_BOT_TOKEN not set"; }

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · discord-admin.sh (reported line 35)May include surrounding context.

sh
# API wrapper
api() {
    local method=$1 endpoint=$2 data=$3
    local response=$(curl -s -w "\n%{http_code}" -X "$method" \
        "$API_BASE$endpoint" \
        -H "Authorization: Bot $BOT_TOKEN" \
        -H "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill exposes irreversible or high-impact actions such as kicking, banning, pruning members, deleting messages, and bulk deletion, but provides no confirmation prompt or warning text before execution. Although administration is the script's purpose, the file does not disclose the destructive nature of these commands to users in help text, comments, or runtime prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest and help text present this as a complete A-Z Discord administration CLI, including msg-search. However, the code implements search via /guilds/.../messages/search, which is not a normal bot-admin API pattern and does not align with the claimed robust server-control functionality. This is a semantic mismatch between advertised capability and actual implemented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The help section describes modlog-set/get/disable as managing a dedicated moderation log channel. The implementation simply reads and writes system_channel_id on the guild, which controls Discord's system channel and is not the same as a moderation log configuration. This directly contradicts the documented intent of the feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Allowing the bot token to be passed as a command-line argument exposes the credential through process listings, shell history, CI logs, and telemetry on multi-user or monitored systems. In this skill's context, the token grants broad Discord administrative control, so disclosure can lead to full server compromise through the bot's permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script exposes destructive operations such as channel deletion, role deletion, kicking, banning, and message deletion with no confirmation prompt, dry-run mode, or safeguard. In a full-server administration skill, this increases the chance of accidental or automated misuse causing immediate integrity and availability damage to a Discord server.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · discord-ctrl.sh (reported line 61)May include surrounding context.

sh
local endpoint="$2"
    local data="$3"
    
    curl -s -X "$method" \
        "https://discord.com/api/v10$endpoint" \
        -H "Authorization: Bot $BOT_TOKEN" \
        -H "Content-Type: application/json" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The webhook embed example contains Chinese text ("内容") even though the rest of the skill is documented in English, and the skill does not explain any locale-specific behavior or provide a user language choice. This can be read as an unexplained language preference in user-facing content examples.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes 'Complete A-Z Discord server administration' including AutoMod, webhooks, templates, audit logs, scheduled events, threads, and full server control via CLI. The help text and implemented commands only cover a narrower subset: channels, roles, member kick/ban, basic message send/delete, server info, and emoji listing, with no support for the other advertised capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.