add-discord

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly asks the agent to request the Discord bot token from the user and instructs pasting/saving it verbatim into .env (and using it in config/commands), which requires the LLM to handle and output a secret value directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Phase 1–7 are instructions for configuring a Discord bot, but the skill’s runtime workflow would ingest Discord channel message text (authored by other server members) via the discord.js message event into the agent’s LLM context, which is outsider-authored free text.