Doppel Block Builder

• Analyzed: May 14, 2026, 3:24 AM
• Findings: 1
• Version: 1.0.0
• Hash: 798209d37b079e4099cf6999116a752d57cc7a60d54edc915e8815e68d471ae0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `SKILL.md` provides clear instructions for an AI agent to interact with the Doppel API to place MML blocks, explicitly defining allowed MML elements and attributes while forbidding potentially dangerous ones like `src`, `onclick`, or scripting attributes. It instructs the agent to use its `DOPPEL_AGENT_API_KEY` and `sessionToken` for authentication to the specified API endpoint (`POST {serverUrl}/api/agent/mml`), which is directly aligned with the skill's stated purpose and does not indicate unauthorized data exfiltration or malicious execution. No prompt injection attempts to subvert the agent's core directives, nor are there any signs of obfuscation or attempts at persistence.