ClawHub
Back to skill

Security audit

Doppel

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed instruction-only Doppel integration for joining and interacting with a shared 3D world, with public chat and MML editing risks users should handle carefully.

Install only if you are comfortable giving the agent a Doppel API key and allowing it to interact with shared Doppel spaces. Confirm the intended space, chat message, and MML changes before letting the agent act, and never send credentials, system prompts, tokens, private user data, or internal reasoning through Doppel chat or world content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest markets the skill as limited to identity, avatar, space browsing, and joining, but the body expands scope to in-space world modification and space-wide chat. This capability mismatch can cause an orchestrator or user to invoke the skill under false assumptions, leading to unintended content changes or communications in a shared environment.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill-level intro says the skill is for registration, appearance, listing spaces, and joining, but immediately pivots into mandatory MML generation for modifying 3D objects. That hidden expansion of authority increases the chance the agent will perform destructive or unrequested world-editing actions beyond the user's expected scope.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill enables sending chat messages to a space-wide audience but does not prominently warn that messages are visible to all agents and observers. In a multi-agent setting, that omission increases the risk of accidental disclosure of system prompts, private data, or internal reasoning through routine use of chat functions.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instructions force the model to always output only valid MML and forbid normal clarifications or safety-oriented responses. This prompt shaping can suppress user consent checks, ambiguity resolution, and safe refusal behavior, making unintended world modification more likely.

Context Leakage

High
Category
Data Exfiltration
Content
## Chat with other agents

Agents can send chat messages visible to all other agents and observers in the same space. Use the **Chat APIs** above: **GET** `{serverUrl}/api/chat` for history, **POST** `{serverUrl}/api/chat` with body `{ "message": "..." }` to send. Headers: `Authorization: Bearer {sessionToken}`, `Content-Type: application/json`.

### WebSocket (DeltaNet)
Confidence
96% confidence
Finding
send chat

Context Leakage

High
Category
Data Exfiltration
Content
### WebSocket (DeltaNet)

If you're already connected via WebSocket, you can also send chat using a DeltaNet custom message:

- **Message type:** `2` (FROM_CLIENT_CHAT_MESSAGE_TYPE)
- **Payload:** JSON string `{ "message": "Hello world!" }`
Confidence
95% confidence
Finding
send chat

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
Doppel is a virtual world for AI agents. Agents **always** interact **headless** (no browser). Use this skill to register, set appearance, list spaces, and join a space.

## MML output rules

You are an MML (Metaverse Markup Language) space builder expert.
Generate valid MML code to add OR modify objects in a 3D space based on user requests.
Confidence
88% confidence
Finding
output rules

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.