bot.py

import discord
import random
import subprocess
import asyncio 
import aiohttp
import logging 
import json
import time
import sys 
import os 
import re 

sys.dont_write_bytecode = True

prefix = '>>'

intents = discord.Intents.default()
intents.message_content = True

async def arun(cmd): # asynchronous terminal command running (for bash, etc)
    if "win32" in sys.platform:
        print("{}Unfortunately, Centi has a heavy reliance on Linux-based commands.\nPlease use Centi with WSL!{}".format(pr.error, pr.clear))
        raise RuntimeError("Please use WSL!")
    proc = await asyncio.create_subprocess_shell(
        cmd,
        stdout=asyncio.subprocess.PIPE,
        stderr=asyncio.subprocess.PIPE)

    stdout, stderr = await proc.communicate()
    proc.stdout = stdout.decode()

    if proc.returncode != 0:
        print(f'[{cmd.split()[0]!r} exited with {proc.returncode}]')
    if stdout:
        print(f'[stdout]\n{stdout.decode()}')
    if stderr:
        print(f'[stderr]\n{stderr.decode()}')

class MyClient(discord.Client):
    
    async def on_ready(self):
      print ('\033[1mWelcome to the This Mess by \33[31mRobin Universe\033[0m')
      print ('Bot core loaded as user:', self.user)

    async def on_message(self, message):
        msgCaps = message.content
        msg     = message.content.lower()

        if message.author == self.user:
            return

        a = random.randint(1,50)
        print("DICE: " + str(a))
        if a == 2:
            print("DICE: MATCH! GENERATING IMAGE FROM PROMPT: " + msg)
            await message.add_reaction("😳")
            #await subprocess.check_output(["txt2img", ('--prompt "' + msg + '"'),"--output /tmp/img.png", "--num-inference-steps 10"], shell=True)
            cmd = await arun('txt2img --prompt "' + msg + '" --output /tmp/gen.png --num-inference-steps 35')

        if os.path.exists("/tmp/gen.png"):
            print("New file detected. Sending message.")
            await message.reply(file=discord.File('/tmp/gen.png'))
            os.remove('/tmp/gen.png')


client = MyClient(intents=intents)
client.run('no')

Hey this looks like it's vulnerable to RCE via shell injection on this line:

cmd = await arun('txt2img --prompt "' + msg + '" --output /tmp/gen.png --num-inference-steps 35')

You probably want to use create_subprocess_exec instead of create_subprocess_shell, which takes an array of args - then there's no need to worry about string escaping.

https://docs.python.org/3/library/asyncio-subprocess.html#asyncio.create_subprocess_exec

You might also want to use a lock or semaphore to make sure that only one instance of the command runs at once: https://docs.python.org/3/library/asyncio-sync.html