The Agent Skills Directory

[DATA_EXFILTRATION]: The skill defines actions such as sendMessage, emojiUpload, and stickerUpload that explicitly support the file:/// protocol via a mediaUrl parameter. This feature allows the agent to read arbitrary files from the local filesystem and upload or send them to Discord. This represents a significant data exfiltration risk, as an attacker could instruct the agent to exfiltrate sensitive files, including private keys (e.g., ~/.ssh/id_rsa), configuration files with secrets (.env), or cloud provider credentials.
[EXTERNAL_DOWNLOADS]: The mediaUrl parameter in multiple actions also allows the agent to fetch content from arbitrary https:// URLs. This capability enables interaction with untrusted external servers and the retrieval of potentially malicious content.
[PROMPT_INJECTION]: The skill presents a high risk for indirect prompt injection.
Ingestion points: The agent ingests untrusted data from external sources through the readMessages, fetchMessage, and searchMessages actions.
Boundary markers: The instructions provide no delimiters or safety guidelines to help the agent distinguish between its own instructions and the content of the Discord messages it reads.
Capability inventory: The skill provides a large suite of administrative tools, including channelDelete, roleAdd, and timeout, alongside the dangerous file:/// access.
Sanitization: There is no mention of sanitization or validation for the retrieved message content before it is processed.

discord