Discord

Control Discord via Clawdbot to send messages, react, post stickers/emojis, run polls, manage threads/pins/search, fetch info, and moderate channels or DMs.

This instruction-only Discord skill appears to do what it claims, but there are important surprises to be aware of: it implicitly expects a pre-configured 'Clawdbot' bot token and a 'discord' tool on the agent even though no credentials or binaries are declared; it allows uploading local files (file:/// paths), which will read and transmit files from the agent host to Discord; and it supports powerful moderation and role-change actions (disabled by default) that require high privileges. Before installing: 1) confirm where the Clawdbot token is stored and whether you are willing to expose it to this skill; 2) limit the bot's permission scope on Discord (least privilege) and keep moderation/roles disabled unless explicitly needed; 3) restrict or audit the agent's filesystem access if you do not want arbitrary local files uploaded; 4) test in a non-production server first; and 5) prefer a skill with an explicit homepage/source or clear declaration of required credentials/tools — ask the publisher for the source code or details if you need higher assurance.

Type: OpenClaw Skill Name: taizi-discord Version: 1.0.2 The skill bundle documents a Discord integration in SKILL.md that includes high-risk file access capabilities, specifically allowing the agent to upload local files using 'file:///' URIs for actions like 'sendMessage', 'emojiUpload', and 'stickerUpload'. While this functionality is plausibly intended for uploading legitimate media assets, it creates a direct vector for data exfiltration if the agent is manipulated via prompt injection. The bundle also describes broad administrative actions such as moderation and role management, although these are noted as being disabled by default.