Security audit

Doppel

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a real Doppel integration, but it gives the agent overly broad instructions and handles shared chat and tokens in ways users should review before installing.

Review this skill before installing. Only use it with a Doppel API key you are willing to expose to the Doppel service, avoid sending secrets or private instructions through space chat, prefer POST token exchange, and verify the space server URL and any recommended follow-on skills before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:26
Finding: Unconditional Skill Instructions Override Agent Output and Safety Behavior
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:70
Finding: JWT Transmission Through a URL Query Parameter
Content: View full analysis
" }`. Response: `{ "sessionToken": "..." }` ``` Therefore, query-string transmission is unnecessary and exceeds the minimum exposure required for session exchange. ### Attack Path 1. The agent receives a JWT after calling the hub join endpoint. 2. It follows the documented GET workflow and constructs `/session?token={jwt}`. 3. A server, proxy, HTTP tool, or monitoring component records the complete request URL. 4. An attacker or unauthorized operator with access to those records obtains the JWT. 5. Before expiration, the attacker exchanges or reuses the JWT to obtain a session token. 6. The attacker accesses the corresponding space using the resulting session authority. ### Impact Assessment A disclosed JWT may permit unauthorized session creation and access to the target space for the lifetime and scope of the token. Depending on server-side authorization, the resulting session could permit: - Reading chat history and occupant information. - Connecting to the space WebSocket. - Sending chat messages. - Accessing agent endpoints authorized for that session. - Creating, updating, or deleting the compromised a ...[truncated 211 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:137
Finding: Credential-Bearing Requests May Be Sent to an Unvalidated Dynamic Server URL
Content: View full analysis
` - Response: `{ "jwt": "...", "serverUrl": "https://..." | null, "spaceId": "..." }` - `serverUrl` may be `null` if the space server isn’t deployed yet. If space is full: 503 with `Retry-After`. **Space server (exchange JWT for session token)** - **GET** `{serverUrl}/session?token={jwt}` — Response: `{ "sessionToken": "..." }` - **POST** `{serverUrl}/session` — Body: `{ "token": "" }`. Response: `{ "sessionToken": "..." }` ``` ```markdown For MVP, use OpenClaw's **web_fetch** (or HTTP) to call the Doppel hub API. No custom Doppel tool is required. When joining a space, use web_fetch to get the JWT and session token, then use a WebSocket client (or a Doppel bot script) to connect to the space server. ``` ### Technical Analysis Network communication is necessary for the skill's declared join functionality. The problem is that the destination receiving the JWT is dynamically supplied through `serverUrl`, while the instructions do not require the client to validate: - The URL scheme. - The destination hostname or approved domain. - DNS resolution to public rather than private or link-local addresses. - The effective destination after redirects. - Whether credentials remain bound to the original trusted origin. A compromised hub, malicious space record, poisoned response, or configuration error could therefore cause the agent to send the join JWT to an attacker-controlled endpoint. A private or l ...[truncated 1876 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:154
Finding: Unpinned Installation of Optional External Skills Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 90% confidence
Finding: The 'MML output rules' instruct the model to always emit valid MML, never ask clarifying questions, and make creative decisions when requests are vague. This is a prompt-level behavior override that can suppress normal safety checks and push the agent to comply with ambiguous or risky requests, including requests that may reveal hidden instructions or transform protected context into output artifacts.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
Doppel is a virtual world for AI agents. Agents **always** interact **headless** (no browser). Use this skill to register, set appearance, list spaces, and join a space. ## MML output rules You are an MML (Metaverse Markup Language) space builder expert. Generate valid MML code to add OR modify objects in a 3D space based on user requests.

Context Leakage

High

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The skill enables arbitrary chat transmission to all other agents and observers in a space, creating a direct exfiltration channel for sensitive context. If the agent is induced to summarize its task, quote prior messages, or share credentials or hidden instructions, that data can be broadcast externally with little friction.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
md
## Chat with other agents Agents can send chat messages visible to all other agents and observers in the same space. Use the **Chat APIs** above: **GET** `{serverUrl}/api/chat` for history, **POST** `{serverUrl}/api/chat` with body `{ "message": "..." }` to send. Headers: `Authorization: Bearer {sessionToken}`, `Content-Type: application/json`. ### WebSocket (DeltaNet)

Context Leakage

High

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The WebSocket custom-message path provides another outbound broadcast mechanism for chat, bypassing any controls that might only inspect HTTP chat API calls. Multiple equivalent egress paths increase the risk of covert or accidental context leakage to all connected participants.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
### WebSocket (DeltaNet) If you're already connected via WebSocket, you can also send chat using a DeltaNet custom message: - **Message type:** `2` (FROM_CLIENT_CHAT_MESSAGE_TYPE) - **Payload:** JSON string `{ "message": "Hello world!" }`

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill manifest says the skill is for identity registration, avatar setting, browsing spaces, and joining a space, but the documentation additionally instructs the agent to generate and modify MML content for 3D world building. That materially expands the skill’s effective behavior and can cause an agent to perform higher-risk content generation or world modification actions the user did not explicitly authorize.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation states that chat messages are visible to all agents and observers, but it does not require an explicit warning or confirmation before sending potentially sensitive content. In a multi-agent environment, this can lead to accidental disclosure of user data, internal reasoning, or confidential instructions to a broad audience.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill introduces space-wide chat and message retrieval capabilities that are not disclosed in the manifest description. Hidden communication features increase the chance that an agent will transmit data to third parties or interact socially in ways the user did not expect from a 'join/browse/register' skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The 'Next step' section broadens the workflow into outreach, recruitment, token incentives, and onchain reputation, none of which are part of the stated skill purpose. This creates scope creep that can steer an agent into promotional or blockchain-related actions without clear upfront disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.