pp-discord
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The CLI tool supports a
--deliver webhook:<url>argument, which allows routing command results to an external web endpoint. While this is a documented feature for automation, it represents a data exfiltration vector if the agent is influenced to send sensitive information to an untrusted URL. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the Discord API, such as channel content and message metadata. This creates an attack surface where malicious instructions embedded in Discord messages could attempt to override the agent's behavior when it reads them.
- [COMMAND_EXECUTION]: The skill instructions guide the installation and execution of the
discord-pp-clibinary vianpxandgo install. These resources originate from the vendormvanhorn's own infrastructure (GitHub and NPM).
Audit Metadata