discord-reader
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic injection syntax in
SKILL.mdto execute shell commands at load time. These commands perform environment diagnostics, checking for the presence of theopenclibinary and verifying the connection status to the Discord desktop application. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install a third-party global Node.js package,
@jackwener/opencli, which is the primary tool used for Discord interaction. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources (Discord server messages and search results). While the skill includes instructions for the agent to remain read-only and summarize content, it lacks explicit boundary markers or delimiters to prevent the agent from potentially interpreting instructions embedded within the messages it reads.
- Ingestion points: Commands like
opencli discord-app readandopencli discord-app searchinSKILL.mdandreferences/commands.mdintroduce external data into the agent's context. - Boundary markers: Absent. The skill does not suggest specific delimiters or instructions to ignore embedded commands in the fetched data.
- Capability inventory: The skill possesses shell execution capabilities for interacting with the local system via
opencliand load-time diagnostics. - Sanitization: Absent. The skill does not specify any filtering or sanitization of the message content before processing.
- [COMMAND_EXECUTION]: The skill relies on executing the
openclitool via the shell to list servers, channels, and read messages from the Discord desktop app. - [PERSISTENCE]: Setup instructions advise users to modify their shell profiles (
.zshrcor.bashrc) by adding an environment variable export (OPENCLI_CDP_ENDPOINT) to maintain configuration across sessions.
Audit Metadata