discord

SUSPICIOUS: the skill's stated Discord purpose broadly matches its capabilities, and OAuth mode is coherent and direct to official Discord APIs. The main risk is the BYOC mode: it automates a personal user account using a third-party self-bot library and forwards a full account token to that code, enabling read/write actions as the user. This is higher-risk than a normal API integration and disproportionate compared with safer OAuth or bot-based approaches, though there is no clear evidence of intentional credential exfiltration or malware.