discord-awaken-claw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests public third‑party content — e.g., SKILL.md and direct-handler.js require searching neta-skills and Wikipedia/Wikimedia (curl examples) and downloading arbitrary image URLs, and channel-listener.js calls an external LLM (LITELLM_BASE_URL) — and those externally sourced results are parsed and used to populate charData, update SOUL.md, change the bot avatar/nickname, and drive follow-up actions, so untrusted web/LLM content can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The code performs runtime calls to the external LLM endpoint ${LITELLM_BASE_URL}/chat/completions (called in reference/channel-listener.js) and parses the returned JSON (via parseJSON) to decide actions (guess vs question, awaken flow, profile updates), so remote responses directly control the agent's instructions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs the agent to modify local files (back up and overwrite SOUL.md), install global npm packages, download and write files, and call privileged Discord API endpoints (change bot nickname/avatar) using the bot token — all actions that change machine and service state and can require elevated privileges or expose secrets.