Discord Bridge

Bridge Discord messages to Agent Zero's HTTP API

Security Scan

The skill is mostly what it claims (a Discord→Agent Zero bridge) but there are configuration/metadata inconsistencies and a default behavior that can forward all channel messages to an external API — a potential data‑exfiltration risk you should understand before installing.

Purpose & Capability

The code and SKILL.md match the stated purpose (forward Discord messages to Agent Zero's /api_message endpoint). However the registry metadata declares no required environment variables or primary credential even though the SKILL.md and index.py clearly expect DISCORD_BOT_TOKEN and A0_API_KEY (and other envs). This metadata mismatch is inconsistent and should be corrected.

Instruction Scope

Runtime instructions and the code forward message.content (user messages) plus the configured A0_API_KEY to an external HTTP endpoint. Critically, if DISCORD_CHANNEL_IDS is not set, the bridge will not restrict channels (ALLOWED_CHANNEL_SET empty → messages from all channels are forwarded). That behavior can leak sensitive channel content unless the operator explicitly configures allowed channel IDs.

Install Mechanism

There is no binary download/install spec; SKILL.md instructs pip installing common Python packages (discord.py, aiohttp, python-dotenv) and running index.py. This is a low-risk install mechanism but it does execute code provided in the package locally.

Credentials

The environment variables the skill needs (DISCORD_BOT_TOKEN, A0_API_URL, A0_API_KEY, DISCORD_CHANNEL_IDS, etc.) are reasonable for the stated purpose. But the registry declares no required env/primary credential, which is inconsistent and reduces transparency. Also A0_API_KEY is sent in each request to the external API — ensure that key is scoped and trusted, since it will be transmitted in plaintext in the JSON payload.

Persistence & Privilege

The skill is a user-invocable long-running bot (normal). It does not request 'always: true' or modify other skills or system-wide configs. It requires the message_content intent (discord) which is expected for reading messages.

What to consider before installing

Before installing, understand that this skill will forward Discord message text to whatever A0_API_URL you configure and include the A0_API_KEY in each request. To reduce risk: (1) only run it against an Agent Zero endpoint you control or trust; (2) explicitly set DISCORD_CHANNEL_IDS to a small list of allowed channel IDs — if you leave it empty the bot will forward messages from all channels; (3) create a scoped API key for the bridge rather than using a high-privilege token; (4) run the code in an isolated environment and review index.py yourself (it’s short and readable); (5) update registry metadata to declare required env vars so others can audit easily; and (6) be aware Discord's message_content intent is privileged and may require bot verification. If you need help auditing or hardening (e.g., adding message filtering, logging controls, or encryption), get a developer to review and modify the code before deploying.

Discord Bridge Skill

Overview

Bridges Discord messages to Agent Zero's api_message HTTP endpoint, enabling Discord users to interact with Agent Zero agents.

Purpose

• Forward Discord messages from specific channels to Agent Zero
• Handle async Discord bot events
• Support command prefix filtering
• Session-based message bridging

Input Variables

Variable	Description	Example
{{DISCORD_BOT_TOKEN}}	Discord bot authentication token	Bot token from Discord Developer Portal
{{A0_API_URL}}	Agent Zero API endpoint	http://localhost:80/api_message
{{A0_API_KEY}}	Agent Zero API authentication	mcp_server_token from settings
{{DISCORD_CHANNEL_IDS}}	Comma-separated allowed channel IDs	"123456789,987654321"
{{BOT_CMD_PREFIX}}	Command prefix for bot commands	"!"

Triggers

• Discord on_message event
• Filtered by ALLOWED_CHANNEL_SET (if configured)
• Messages containing command prefix for special handling

APIs & Dependencies

• discord.py: Discord bot framework
• aiohttp: Async HTTP client for API calls
• python-dotenv: Environment variable management

Files

• index.py - Main Discord bot logic
• .env.example - Environment template

Usage

# Install dependencies
pip install discord.py aiohttp python-dotenv

# Configure environment
cp .env.example .env
# Edit .env with your credentials

# Run the bridge
python index.py