discord-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Discord OpenAPI specification from the platform's public GitHub repository. This is a routine operation from a well-known service.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from Discord API responses and Gateway events. To mitigate risks, the documentation explicitly requires the agent to obtain human confirmation before executing high-risk operations like sending messages or server management.
- Ingestion points: Discord REST API responses and Gateway WebSocket events (e.g., MESSAGE_CREATE).
- Boundary markers: The skill includes instructions to confirm intent before write operations.
- Capability inventory: The skill uses uxc to perform network requests to Discord and save subscription data to a local file.
- Sanitization: Relies on standard JSON processing; no additional instruction-level sanitization is specified.- [COMMAND_EXECUTION]: The skill utilizes command-line aliases and shell scripts for API interaction and local validation. These are scoped correctly to the skill's primary purpose and do not perform unauthorized actions.
Audit Metadata