The Agent Skills Directory

[DATA_EXFILTRATION]: The skill manages a DISCORD_BOT_TOKEN used to authenticate with the official Discord API (https://discord.com/api/v10). Credentials are resolved through environment variables (env:DISCORD_BOT_TOKEN) or a managed auth layer, which is a standard and secure practice for this type of integration. No unauthorized exfiltration of the token or other sensitive local files was detected.
[COMMAND_EXECUTION]: The cli.js entry point utilizes node:child_process (spawnSync) to execute the connector's own local scripts (dist/cli.js or cli.ts). This is implemented as a readiness wrapper to verify Node.js version compatibility and dependency installation before execution, and does not execute arbitrary or remote commands.
[PROMPT_INJECTION]: As a communication tool, the skill includes scripts like listChannelMessages and getMessage that ingest external data into the agent's context. While this creates a surface for indirect prompt injection, it is an expected functionality for a Discord bot and is documented with warnings regarding name-to-id resolution collisions.

discord