Discord Local STT/TTS Installer (macOS)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:11 PM UTC
• Version: 0.1.1

Overview

This skill is an installer for a Discord voice plugin, but it should be reviewed carefully because it downloads mutable GitHub source and may run local package/build scripts without verification.

Install only if you trust the GitHub repository and are comfortable with the latest upstream release and dependencies running under your user account. Prefer a pinned, checksummed release artifact or inspect the downloaded source before running the installer and restarting OpenClaw.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: bin/install.sh:18

Finding

Unverified Mutable Remote Payload Download and Execution

Content

View full analysis

&2 exit 1 fi BACKUP_DIR="${INSTALL_DIR}.bak.$(date +%Y%m%d-%H%M%S)" if [[ -d "$INSTALL_DIR" ]]; then echo "Backing up existing install to: $BACKUP_DIR" mv "$INSTALL_DIR" "$BACKUP_DIR" fi echo "Installing to: $INSTALL_DIR" mkdir -p "$INSTALL_DIR" cp -R "$TOP_DIR"/* "$INSTALL_DIR"/ # Optional: build if dependencies exist if command -v pnpm >/dev/null 2>&1; then echo "pnpm found: installing deps + building (best effort)" (cd "$INSTALL_DIR" && pnpm i && pnpm -s build) || true else echo "pnpm not found: skipping build. If the plugin is not runnable, install pnpm and build manually." fi ``` ### Technical Analysis The installer queries GitHub's mutable `releases/latest` endpoint, accepts the returned `zipball_url`, and downloads and installs that archive without verifying an expected cryptographic checksum, trusted signature, immutable commit identifier, or release provenance. Consequently, the effective code installed by the skill can change after the skill itself has been reviewed. If the upstream repository, its maintainer accou ...[truncated 2555 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs users to run a local shell installer (bash bin/install.sh) that downloads and installs code from the latest GitHub Release, but the manifest declares no permissions or allowed-tools scope. This creates a transparency and trust problem: consumers and policy systems cannot easily see that the skill performs shell-capable installation of remote code, increasing the risk of unintended execution and supply-chain exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script fetches release metadata and a source zip from GitHub, then may run pnpm i and pnpm -s build, which can download dependencies and execute package lifecycle scripts. Although there are progress messages, there is no explicit safety warning that remote content will be downloaded and local build commands may run.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bin/install.sh (reported line 22)May include surrounding context.

sh

echo "Fetching latest release info for $REPO ..."
LATEST_JSON="$TMP_DIR/latest.json"
curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" -o "$LATEST_JSON"

TAG="$(python3 - <<'PY'
import json

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bin/install.sh (reported line 22)May include surrounding context.

sh

echo "Fetching latest release info for $REPO ..."
LATEST_JSON="$TMP_DIR/latest.json"
curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" -o "$LATEST_JSON"

TAG="$(python3 - <<'PY'
import json

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installer claims to install from GitHub Releases, but it actually downloads the release's source zipball and copies repository contents directly into the plugin directory. This is riskier because source archives are not necessarily curated build artifacts, and the script then treats whatever is in the repository as installable code, increasing supply-chain exposure and making the install behavior broader than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script replaces the existing installation automatically by moving the current directory to a timestamped backup and copying in new contents, without asking for confirmation or validating the destination contents. While not overtly malicious, this can cause unintended overwrites, broken installs, or persistence of attacker-controlled files if the source archive is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

After downloading repository-controlled content, the installer conditionally runs pnpm i and pnpm -s build, which can execute arbitrary lifecycle scripts from the fetched package metadata and dependencies. That turns a simple installer into remote code execution on the local machine under the user's account, with behavior not obviously constrained to copying files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.