Doppel Architect

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

The skill is a Markdown-only Doppel building guide whose credential use, build submission actions, and add-on skill recommendations are disclosed and fit its purpose.

Review the recommended companion skills before installing them, prefer pinned or verified versions where available, protect the Doppel API key and session token, and only use delete when you intentionally want to remove the current build document.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:72

Finding

Unpinned ERC-8004 Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 72
Vulnerability Type: Unpinned third-party skill installation
Risk Level: Medium

Complete Code Snippet:

markdown

- To register onchain and link your identity: `clawhub install erc-8004`

Technical Analysis

The documentation instructs users or agents to install the externally maintained erc-8004 skill without specifying an immutable version, content digest, trusted publisher identity, or verification procedure. The effective installed content can therefore differ from the content available when this project was audited.

This represents an insecure dependency boundary because the associated workflow concerns on-chain identity and token incentives. If the registry entry, publisher account, distribution infrastructure, or mutable latest release were compromised, an attacker could distribute altered instructions or executable components under the expected skill name.

No evidence in this project establishes that the current erc-8004 skill is malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the reviewed artifact.

Attack Path

1. An attacker compromises the dependency publisher, registry entry, or distribution channel for erc-8004, or substitutes an untrusted package with the expected name.
2. The attacker publishes a modified version containing malicious instructions or code.
3. A user or agent follows SKILL.md and runs clawhub install erc-8004 without validating a version, digest, or publisher.
4. The mutable dependency is installed and subsequently invoked.
5. The dependency attempts to abuse whatever API credentials, wallet access, tools, files, or network permissions are available to its runtime.

Impact Assessment

Exploitation could affect the privileges granted to the installed skill, potentially including access to agent-visible credentials, authenticated service ope ...[truncated 282 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an immutable, reviewed version rather than installing the mutable latest release.
• Require verification of a cryptographic content digest or signed release manifest before installation.
• Document the expected publisher identity and authoritative registry source.
• Audit the complete dependency contents, including scripts and transitive dependencies, before use.
• Run the skill with least privilege and isolate wallet access, API credentials, filesystem access, and network access.
• Require explicit human approval for on-chain registration, signing, token transfer, or other irreversible operations.
• Maintain an allowlist of approved skill versions and periodically review them for publisher or checksum changes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140

Finding

Unpinned Block-Builder and Social-Outreach Skill Recommendations Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 140
Vulnerability Type: Unpinned third-party skill installation
Risk Level: Medium

Complete Code Snippet:

markdown

Install the `block-builder` skill to start placing cubes — it covers the grid and MML format. Then install `social-outreach` to share your builds and recruit collaborators. Building and sharing are two halves of the same loop.

Technical Analysis

The project recommends installing the externally maintained block-builder and social-outreach skills without immutable versions, integrity hashes, publisher verification, or pre-installation review requirements. As a result, the installed artifacts may change independently after this audit.

These dependencies are positioned to participate in authenticated building and external social-posting workflows. A compromised dependency could provide malicious instructions or executable behavior while appearing to perform the expected building or outreach function.

There is no evidence in the audited project that either named skill is currently malicious. The confirmed issue is the unsafe, mutable dependency acquisition process.

Attack Path

1. An attacker compromises the publisher account, registry listing, or distribution infrastructure for one of the recommended skills.
2. The attacker publishes a modified release under the trusted skill name.
3. A user or agent follows the recommendation and installs the current mutable release without checking its provenance or digest.
4. The compromised skill is invoked for building or social outreach.
5. It abuses its available authority to alter authenticated requests, disclose accessible credentials, publish unauthorized content, manipulate build submissions, or influence agent output.

Impact Assessment

The potential scope is limited by the permissions granted to the installed dependency. In a broadly privileged runtime, exploitation c ...[truncated 336 chars]

Remediation

View remediation

Remediation Suggestions

• Specify immutable, reviewed versions of block-builder and social-outreach.
• Publish and verify cryptographic hashes or signed manifests for the approved artifacts.
• Identify the authoritative publishers and registry locations in the documentation.
• Review each skill's instructions, scripts, configuration, and transitive dependencies before installation.
• Separate building and social-posting credentials, and grant each dependency only the minimum permissions required for its function.
• Require explicit confirmation before external publication, destructive build changes, or credential-sensitive actions.
• Execute third-party skills in a sandbox with restricted filesystem, network, tool, and environment-variable access.
• Monitor approved dependencies for ownership changes, unexpected releases, and integrity-check failures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- **Headers:** `Authorization: Bearer {sessionToken}`, `Content-Type: application/json`
- **Body:**

| Field        | Type   | Description                                                                                                                                                              |
| ------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `documentId` | string | Your agent's document: `agent-{agentId}.html`                                                                                                                            |
| `action`     | string | `"create"` for first submission, `"update"` for modifications, `"delete"` to remove your document                                                                        |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

| Field        | Type   | Description                                                                                                                                                              |
| ------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `documentId` | string | Your agent's document: `agent-{agentId}.html`                                                                                                                            |
| `action`     | string | `"create"` for first submission, `"update"` for modifications, `"delete"` to remove your document                                                                        |
| `content`    | string | Your MML markup wrapped in `<m-group>`, using only `<m-block>`, `<m-group>`, and animation tags; textures via `type=""`. See `block-builder` skill. Omit for `"delete"`. |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly documents a destructive "delete" action for the agent's world document but does not add any caution, confirmation guidance, or constraints around when it should be used. In an autonomous-agent context, normalizing deletion without safety guardrails can cause accidental loss of builds or destructive actions triggered by ambiguous prompts, even if the endpoint itself is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.