name: discord-ops
description: >
TOS-compliant Discord notification monitor. Watches YOUR Discord server for
security content forwarded by researchers, matches keywords, and pushes to
paper-writer/dogpile via webhooks. Persists to graph-memory for semantic search.
allowed-tools:
- Bash
- Read
- Write
triggers:
- discord
- discord monitor
- discord notifications
- discord keywords
- security discord
- discord webhook
metadata:
short-description: Discord keyword monitor with webhook + memory integration

Discord Operations - Notification Monitor Model

TOS-compliant approach to Discord security intelligence gathering.

The Key Insight

OLD (Broken): Try to search external servers where you're not admin → TOS violation, impossible

NEW (Works): Monitor YOUR OWN server for content forwarded by researchers → 100% compliant

Architecture

┌───────────────────────────────────────────────────────────────────────────────┐
│                   TOS-Compliant Discord Pipeline + Memory                      │
├───────────────────────────────────────────────────────────────────────────────┤
│                                                                                │
│  External Sources              Your Server (Admin)            Consumers        │
│  ────────────────              ────────────────────            ─────────        │
│                                                                                │
│  ┌─────────────┐               ┌──────────────────┐                           │
│  │ Researchers │──DM/forward──▶│ #security-intel  │                           │
│  │ share       │               │                  │                           │
│  │ insights    │               │  Your Bot        │──webhook──▶ paper-writer  │
│  └─────────────┘               │  (keyword watch) │                           │
│                                │                  │──webhook──▶ dogpile       │
│  ┌─────────────┐               │  Keywords:       │                           │
│  │ Telegram    │──bridge──▶    │  CVE, DARPA,     │                           │
│  │ bridges     │  (social-     │  HTB, 0-day...   │                           │
│  └─────────────┘   bridge)     └────────┬─────────┘                           │
│                                         │                                      │
│                           ┌─────────────┼─────────────┐                       │
│                           ▼             ▼             ▼                        │
│                    ┌──────────┐  ┌──────────────┐  ┌────────────┐             │
│                    │ matches  │  │ graph-memory │  │  dogpile   │             │
│                    │ .jsonl   │  │  (ArangoDB)  │  │  search    │             │
│                    │ (local)  │  │   lessons    │  │            │             │
│                    └──────────┘  └──────┬───────┘  └─────┬──────┘             │
│                                         │                │                     │
│                                         └────────────────┘                     │
│                                         (semantic recall)                      │
│                                                                                │
└───────────────────────────────────────────────────────────────────────────────┘

Quick Start

# 1. Check setup
./run.sh setup

# 2. Add your Discord server to monitor
./run.sh guild add "Security Intel" 1234567890123456789

# 3. Add webhook for forwarding matches
./run.sh webhook add alerts "https://discord.com/api/webhooks/..."

# 4. Start monitoring
./run.sh monitor start --webhook alerts

Commands

setup - Check Configuration

./run.sh setup

Shows status of:
- Bot token (from env or clawdbot)
- discord.py library
- httpx for webhooks
- Current configuration

keywords - Manage Watch Patterns

# List all keywords (regex patterns)
./run.sh keywords list

# Add a keyword pattern
./run.sh keywords add "CVE-2025-\d+"
./run.sh keywords add "supply.?chain"

# Remove a pattern
./run.sh keywords remove "HTB"

# Reset to defaults
./run.sh keywords reset

Default Keywords:
- Vulnerabilities: CVE-\d{4}-\d+, 0-?day, exploit, RCE, LPE, privesc
- Programs: DARPA, IARPA, BAA, grants?\.gov
- Platforms: HTB, TryHackMe, CTF
- Threat Intel: APT\d+, malware, ransomware, C2, cobalt.?strike
- Techniques: MITRE, ATT&CK, T\d{4}

guild - Manage Monitored Servers

# List monitored guilds
./run.sh guild list

# Add a guild to monitor
./run.sh guild add "My Server" 1234567890123456789

# Remove a guild
./run.sh guild remove "My Server"

webhook - Manage Output Webhooks

# List webhooks
./run.sh webhook list

# Add a webhook
./run.sh webhook add alerts "https://discord.com/api/webhooks/..."
./run.sh webhook add paper-writer "http://localhost:8000/paperwriter/discord"

# Remove a webhook
./run.sh webhook remove alerts

# Test a webhook
./run.sh webhook test alerts

monitor - Run the Monitor

# Check status
./run.sh monitor status

# Start monitoring (foreground)
./run.sh monitor start --webhook alerts

# Start in dry-run mode (log only, don't forward)
./run.sh monitor start --dry-run

# Stop the monitor
./run.sh monitor stop

matches - View Logged Matches

# Show recent matches
./run.sh matches

# Show more matches
./run.sh matches --limit 50

# Filter by keyword
./run.sh matches --keyword CVE

# Output as JSON
./run.sh matches --json

memory - Knowledge Graph Integration

# Check memory integration status
./run.sh memory status

# Search stored matches in memory
./run.sh memory search "CVE-2024"

# Search with JSON output
./run.sh memory search "ransomware" --json --k 20

# Ingest existing matches from log file to memory
./run.sh memory ingest --limit 100

Auto-Persistence:
The monitor automatically persists matches to memory by default:

# Start with memory persistence (default)
./run.sh monitor start --webhook alerts

# Start without memory persistence
./run.sh monitor start --webhook alerts --no-persist

Webhook Payload Formats

Discord Webhook (auto-detected by URL)

{
  "embeds": [{
    "title": "Keyword Match: CVE-2024-1234, exploit",
    "description": "New RCE exploit for CVE-2024-1234...",
    "url": "https://discord.com/channels/...",
    "color": 5793266,
    "author": {"name": "researcher#1234"},
    "footer": {"text": "Security Intel #cve-alerts"},
    "timestamp": "2026-01-28T12:00:00Z"
  }]
}

Generic Webhook (paper-writer/dogpile)

{
  "source": "discord",
  "content": "New RCE exploit for CVE-2024-1234...",
  "author": "researcher#1234",
  "channel": "Security Intel/#cve-alerts",
  "url": "https://discord.com/channels/...",
  "keywords": ["CVE-2024-1234", "exploit"],
  "timestamp": "2026-01-28T12:00:00Z"
}

Setup Your Security Intel Server

Step 1: Create Server

Create a Discord server for aggregating security intel:
- #cve-alerts - CVE announcements
- #research-feed - General security research
- #threat-intel - APT/malware news
- #darpa-baa - Funding opportunities

Step 2: Add Your Bot

1. Use the bot from clawdbot or create a new one
2. Required permissions: Read Messages, Read Message History, View Channels
3. Get guild ID: Server Settings → Widget → Server ID

Step 3: Invite Researchers

• Researchers can forward content from other servers to your channels
• Or set up Telegram bridges (see social-bridge skill)
• Bot watches for keywords in YOUR server only

Step 4: Configure Webhooks

Create webhooks in your destination channels or endpoints:
- Discord webhook for alerts channel
- HTTP webhook for paper-writer integration
- Generic webhook for ArangoDB logging

Integration with paper-writer

# paper-writer endpoint receives Discord matches
POST /paperwriter/discord
{
  "source": "discord",
  "content": "...",
  "keywords": ["CVE-...", "exploit"],
  ...
}

# Gets auto-indexed alongside arXiv/SAM.gov pulls

Integration with social-bridge

The social-bridge skill can forward Telegram content to your Discord server:

Telegram Public Channels → social-bridge → Your Discord → discord-ops → paper-writer

Environment Variables

Files

.pi/skills/discord-ops/
├── discord_ops.py    # Main CLI
├── run.sh            # Runner script
├── config.json       # Guilds and webhooks config
├── keywords.json     # Watched keyword patterns
├── matches.jsonl     # Logged keyword matches
└── monitor.pid       # PID file when running

Why This Works

Comparison with Old Approach