discord

SUSPICIOUS. The skill's purpose matches Discord automation, and the CLI appears to come from the claimed publisher, but the actual footprint depends on a third-party broker that stores Discord OAuth access and receives the agent's ClawLink credential. The main risk is not obvious malware; it is credential delegation and message/action data flowing through ClawLink instead of direct Discord APIs, plus unpinned npx execution and write-capable actions.