Openclaw Discord Setup

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  1.0.0

Overview

This is a visible setup guide for connecting OpenClaw to Discord, with expected token and message-permission handling but some privacy choices users should configure carefully.

Use a dedicated Discord bot token, keep it out of public files, restrict allowedGuildIds to trusted servers, and leave DMs disabled unless you have clear consent, access controls, and data-handling expectations. Do not share credentials during remote setup help, and rotate the token if it may have been exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The documentation explicitly enables `allowDM: true` but does not warn that direct messages expand the bot's message scope beyond controlled servers, which can expose private conversations, increase phishing/social-engineering surface, and bypass guild-based access restrictions. In this context, the risk is real because the same document otherwise encourages restricting usage to trusted guild IDs, so presenting DM support without corresponding privacy and authorization guidance can lead to unsafe deployment.

VirusTotal

65/65 vendors flagged this skill as clean.