Comma, single quote, double quote, escape last \ and all your cases are covered.

unfortunately, nearly all AV abides by the “cannot be larger than 68 bytes” rule

Eh, not really. It’s also not a bad implementation, IMO.

You can configure a webserver to detect if the request is coming from a bot (discord) then return one payload (regular html page). Otherwise return another (download the sys file).

There really isn’t a foolproof way to determine this, either, because browsers will just straight download files if it has an extension in the url.

I’m described by this meme and I don’t like it.