discord-harvest

SUSPICIOUS: the skill’s harvesting purpose matches its Discord scraping capabilities, but the overall footprint is high-risk for an AI agent because it installs via transitive skill loading, accesses private Discord DMs through browser automation, processes untrusted external content with write/exec-capable tools, and archives sensitive data locally. The main concern is disproportionate agent power and trust chaining rather than confirmed malware or overt credential theft.