The Agent Skills Directory

[COMMAND_EXECUTION]: The discord-session-manager.sh script is vulnerable to shell command injection. In functions like cmd_spawn and _resolve_workdir, variables derived from Discord channel or thread names (which can be controlled by users) are interpolated directly into shell command strings and inline Python scripts without sanitization. An attacker can craft a channel name containing shell metacharacters (e.g., backticks or semicolons) to execute arbitrary commands on the host machine.
[REMOTE_CODE_EXECUTION]: The skill implements remote command execution capabilities through Discord slash commands such as /run and /skills install. These commands use tmux send-keys to inject arbitrary strings into an active Claude Code TUI. When combined with the --dangerously-skip-permissions flag used in the spawn command, this allows remote users to execute arbitrary tools and scripts on the host without local user confirmation.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in its thread management logic. In cmd_spawn_thread, the script fetches the last 20 messages from a parent Discord channel and interpolates them directly into a system prompt for the new session. Because there are no boundary markers or sanitization, a malicious message in the parent channel can override the instructions of the newly spawned agent.
[DATA_EXFILTRATION]: The skill manages sensitive Discord bot tokens and session state in the user's home directory. The autonomous nature of the agent (running with skipped permissions) combined with remote Discord access creates a significant risk that the agent could be manipulated into reading and exfiltrating its own configuration files, environment variables, or other sensitive files from the host filesystem.

claude-remote-sessions