discord-reader

SUSPICIOUS. The skill's purpose and commands are mostly coherent and read-only, and the npm install appears to be the publisher's official path. However, it requires trusting a third-party CLI to access private Discord data through a local CDP session, instructs enabling remote debugging on the Discord desktop app, and includes load-time pre-execution. These are notable security risks, but there is no clear evidence of credential theft, remote-code execution, or malicious exfiltration.