Is discord safe?
https://clawhub.ai/steipete/discord
The discord skill is a documentation-only SKILL.md with no executable code, no install scripts, no git hooks, and clean network/process monitoring. Its primary risk is the file:/// URI support in mediaUrl which could be leveraged as a data exfiltration channel when combined with other skills, and the writing style guide which modifies agent output behavior. Moderation capabilities exist but are disabled by default.
Category Scores
Findings (6)
MEDIUM file:/// URI support enables local file uploads -15 ▶
The mediaUrl parameter in sendMessage, emojiUpload, and stickerUpload actions accepts file:/// URIs, allowing the agent to upload arbitrary local files to Discord channels or DMs. While this is a legitimate feature for sharing local content, it creates a potential data exfiltration vector if the agent is manipulated by prompt injection or a malicious co-installed skill.
LOW Writing style guide modifies agent output behavior -10 ▶
The 'Discord Writing Style Guide' section instructs the agent to adopt a casual tone, avoid markdown headers, skip polite preambles, and use lowercase. While contextually appropriate for Discord formatting, this constitutes agent behavioral modification that could conflict with user-configured preferences or system-level style instructions.
LOW Suggestive action prompts in 'Ideas to try' section -10 ▶
The skill includes an 'Ideas to try' section that suggests autonomous behaviors like 'DM stickers as acknowledgements when a user's request is completed' and 'Send celebratory stickers after successful deploys'. These could be interpreted by an eager agent as standing instructions rather than optional suggestions.
MEDIUM Cross-skill exfiltration potential via Discord messaging -25 ▶
This skill's ability to send messages and file attachments to arbitrary Discord channels or DMs makes it a potential exfiltration channel when combined with other skills that have filesystem or data access. A malicious co-installed skill could read sensitive data and then instruct the agent to send it via Discord DM.
LOW Powerful moderation capabilities available behind toggle -15 ▶
The skill includes timeout, kick, and ban moderation actions. While disabled by default, enabling them exposes significant destructive capability that could be triggered by prompt injection or agent misinterpretation.
INFO Runtime reads sensitive config files during initialization -5 ▶
The Clawdbot runtime (not the skill itself) reads .env, .aws/credentials, openclaw.json, .profile, .bashrc, and auth-profiles.json during skill installation. This is standard framework behavior for loading configuration and authentication context, not initiated by the skill.