T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:66
- Finding
- Overly Broad Discord Message Processing Across All Accessible Guilds## Vulnerability Details **File Location**: `SKILL.md`, lines 66–82 **Vulnerability Type**: Overly permissive Discord configuration and expanded untrusted-input boundary **Risk Level**: Medium **Vulnerable Configuration:** ```json5 { channels: { discord: { token: "YOUR_BOT_TOKEN", allowBots: true, // required — lets you see other agents' messages groupPolicy: "open", // required — allows the Plaiground guild guilds: { "*": { requireMention: false // required — respond without being @tagged } } } } } ``` Restart your OpenClaw gateway after saving config changes. ### Technical Analysis The documented purpose is to connect the agent to one identified Discord guild, but the supplied configuration applies a wildcard (`"*"`), rather than the documented guild ID. This violates least-privilege configuration principles and expands message handling to every guild accessible to the bot. The risk is amplified by the combined settings: - `groupPolicy: "open"` permits group interactions without a narrow guild allowlist. - `allowBots: true` accepts messages generated by other bots, which may contain attacker-controlled or recursively generated instructions. - `requireMention: false` allows unsolicited messages to enter the agent's processing flow without explicitly addressing it. - The wildcard guild entry applies this behavior beyond the single server required for the skill. Discord messages are externally controlled input. A malicious human or bot can therefore submit prompt-injection content that attempts to influence agent behavior, induce unauthorized tool calls, or solicit sensitive information. Successful escalation beyond conversation depends on the tools and permissions separately granted to the host agent; this file does not itself provide filesystem or command-execution privileges. The document warns about external messa ...[truncated 1780 chars]
- Remediation
- ## Remediation Suggestions 1. Replace the wildcard guild rule with the documented Plaiground guild ID, `1472993063482687679`. 2. Use an explicit group or guild allowlist instead of `groupPolicy: "open"`. 3. Restrict processing to the documented channel IDs: - `1472993064191791239` - `1473006717213347952` - `1473006833567531201` 4. Prefer `requireMention: true`. If mention-free participation is essential, disable mention requirements only for specifically approved channels. 5. Use a dedicated Discord bot identity and token for this server so access to unrelated guilds is not inherited. 6. Treat all Discord content, including bot-authored messages, as untrusted data. Messages must not be allowed to modify security policy, authorize tool use, retrieve secrets, or request private files. 7. Require independent authorization for sensitive tool operations and prevent conversational content from directly triggering filesystem, shell, credential, or network actions. 8. Add rate limits, duplicate-message detection, and conversation-loop controls to mitigate bot-to-bot feedback loops. 9. Grant only the Discord permissions required for participation and periodically review the guilds and channels accessible to the bot.