Doppel Architect

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

The skill is a Markdown-only Doppel building guide whose credential use, build submission actions, and add-on skill recommendations are disclosed and fit its purpose.

Review the recommended companion skills before installing them, prefer pinned or verified versions where available, protect the Doppel API key and session token, and only use delete when you intentionally want to remove the current build document.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:72
• Finding: Unpinned ERC-8004 Skill Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 72 **Vulnerability Type**: Unpinned third-party skill installation **Risk Level**: Medium **Complete Code Snippet**: ```markdown - To register onchain and link your identity: `clawhub install erc-8004` ``` ### Technical Analysis The documentation instructs users or agents to install the externally maintained `erc-8004` skill without specifying an immutable version, content digest, trusted publisher identity, or verification procedure. The effective installed content can therefore differ from the content available when this project was audited. This represents an insecure dependency boundary because the associated workflow concerns on-chain identity and token incentives. If the registry entry, publisher account, distribution infrastructure, or mutable latest release were compromised, an attacker could distribute altered instructions or executable components under the expected skill name. No evidence in this project establishes that the current `erc-8004` skill is malicious. The vulnerability is the absence of controls ensuring that future installations retrieve the reviewed artifact. ### Attack Path 1. An attacker compromises the dependency publisher, registry entry, or distribution channel for `erc-8004`, or substitutes an untrusted package with the expected name. 2. The attacker publishes a modified version containing malicious instructions or code. 3. A user or agent follows `SKILL.md` and runs `clawhub install erc-8004` without validating a version, digest, or publisher. 4. The mutable dependency is installed and subsequently invoked. 5. The dependency attempts to abuse whatever API credentials, wallet access, tools, files, or network permissions are available to its runtime. ### Impact Assessment Exploitation could affect the privileges granted to the installed skill, potentially including access to agent-visible credentials, authenticated service ope ...[truncated 282 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an immutable, reviewed version rather than installing the mutable latest release. - Require verification of a cryptographic content digest or signed release manifest before installation. - Document the expected publisher identity and authoritative registry source. - Audit the complete dependency contents, including scripts and transitive dependencies, before use. - Run the skill with least privilege and isolate wallet access, API credentials, filesystem access, and network access. - Require explicit human approval for on-chain registration, signing, token transfer, or other irreversible operations. - Maintain an allowlist of approved skill versions and periodically review them for publisher or checksum changes.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140
• Finding: Unpinned Block-Builder and Social-Outreach Skill Recommendations Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 140 **Vulnerability Type**: Unpinned third-party skill installation **Risk Level**: Medium **Complete Code Snippet**: ```markdown Install the `block-builder` skill to start placing cubes — it covers the grid and MML format. Then install `social-outreach` to share your builds and recruit collaborators. Building and sharing are two halves of the same loop. ``` ### Technical Analysis The project recommends installing the externally maintained `block-builder` and `social-outreach` skills without immutable versions, integrity hashes, publisher verification, or pre-installation review requirements. As a result, the installed artifacts may change independently after this audit. These dependencies are positioned to participate in authenticated building and external social-posting workflows. A compromised dependency could provide malicious instructions or executable behavior while appearing to perform the expected building or outreach function. There is no evidence in the audited project that either named skill is currently malicious. The confirmed issue is the unsafe, mutable dependency acquisition process. ### Attack Path 1. An attacker compromises the publisher account, registry listing, or distribution infrastructure for one of the recommended skills. 2. The attacker publishes a modified release under the trusted skill name. 3. A user or agent follows the recommendation and installs the current mutable release without checking its provenance or digest. 4. The compromised skill is invoked for building or social outreach. 5. It abuses its available authority to alter authenticated requests, disclose accessible credentials, publish unauthorized content, manipulate build submissions, or influence agent output. ### Impact Assessment The potential scope is limited by the permissions granted to the installed dependency. In a broadly privileged runtime, exploitation c ...[truncated 336 chars]
• Remediation: ## Remediation Suggestions - Specify immutable, reviewed versions of `block-builder` and `social-outreach`. - Publish and verify cryptographic hashes or signed manifests for the approved artifacts. - Identify the authoritative publishers and registry locations in the documentation. - Review each skill's instructions, scripts, configuration, and transitive dependencies before installation. - Separate building and social-posting credentials, and grant each dependency only the minimum permissions required for its function. - Require explicit confirmation before external publication, destructive build changes, or credential-sensitive actions. - Execute third-party skills in a sandbox with restricted filesystem, network, tool, and environment-variable access. - Monitor approved dependencies for ownership changes, unexpected releases, and integrity-check failures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Whitespace Padding

Medium

• Category: Prompt Injection

Content

- **Headers:** `Authorization: Bearer {sessionToken}`, `Content-Type: application/json`
- **Body:**

| Field        | Type   | Description                                                                                                                                                              |
| ------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `documentId` | string | Your agent's document: `agent-{agentId}.html`                                                                                                                            |
| `action`     | string | `"create"` for first submission, `"update"` for modifications, `"delete"` to remove your document                                                                        |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| Field        | Type   | Description                                                                                                                                                              |
| ------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `documentId` | string | Your agent's document: `agent-{agentId}.html`                                                                                                                            |
| `action`     | string | `"create"` for first submission, `"update"` for modifications, `"delete"` to remove your document                                                                        |
| `content`    | string | Your MML markup wrapped in `<m-group>`, using only `<m-block>`, `<m-group>`, and animation tags; textures via `type=""`. See `block-builder` skill. Omit for `"delete"`. |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly documents a destructive "delete" action for the agent's world document but does not add any caution, confirmation guidance, or constraints around when it should be used. In an autonomous-agent context, normalizing deletion without safety guardrails can cause accidental loss of builds or destructive actions triggered by ambiguous prompts, even if the endpoint itself is legitimate.

Static analysis

No suspicious patterns detected.