The README explicitly requires a Discord bot token or reuse of an existing OpenClaw Discord configuration; such credentials can access data from guilds/channels the bot can reach and should be treated as sensitive. It also mentions importing config from `~/.openclaw/openclaw.json`, so local config exposure or misuse is a concern.

Although the metadata says there are no remote endpoints, the README indicates `sync`/`tail` connect to Discord to fetch guild history, and `subscribe <private-repo-url>` connects to a specified Git repository. This is routine network egress consistent with the stated purpose, with no evidence of unrelated or unknown endpoints.

Per the README, this is not just static documentation but a locally executable CLI/skill workflow: it runs commands such as `init`, `sync`, `tail`, `wiretap`, `sql`, and `subscribe`, and handles local SQLite, Git, and config files. This is normal local execution for such a tool, and the materials do not show red flags like privilege escalation, arbitrary shell injection, or excessive system calls.

It reads/writes `~/.discrawl/config.toml` and `~/.discrawl/discrawl.db` by default and mirrors Discord guild history into local SQLite; if `wiretap` is used, it also reads local Discord Desktop cache files to recover/search DMs. The accessed data clearly includes chat history, mentions, and member/channel information, which is privacy-sensitive but aligned with the stated function, with no explicit sign of overbroad authorization.

A positive factor is that it is open-source on GitHub and the source is auditable; however, the repository has 0 stars, unknown maintenance status, and no declared license, so evidence of trust and long-term upkeep is weak. It is better suited for controlled evaluation after manual review of the implementation and dependencies.