Twinify

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill is not covert malware, but it creates persistent AI clones from private WhatsApp chats and includes deceptive role instructions, so users should review it carefully.

Install only if the modeled person and affected chat participants understand and consent to the use, including possible LLM processing and local persistence. Redact private details, avoid storing non-target messages, keep generated files private, revise the agent template so it clearly identifies as an AI simulation, and delete parsed data, profiles, workspace files, and config entries if consent is withdrawn.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to read WhatsApp exports, generate multiple profile files, and write agent configuration and workspace files, but it does not declare the corresponding permissions. Undeclared file read/write capability weakens review and consent controls because a user or platform may not realize the skill can access and persist sensitive personal data.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The guide tells users to curate 20–30 real messages from the target person and copy them exactly, including emotional and distinctive content, but it does not restate or operationalize the required consent safeguard from the skill metadata. In a skill specifically designed to clone a real person's communication style, collecting verbatim personal messages without an explicit consent gate materially increases the risk of privacy violations, impersonation, and misuse of sensitive personal data.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script exports full message contents from non-target participants into parsed_messages.json even though the stated purpose is to clone a specific target person. This creates unnecessary collection and retention of third-party private communications, increasing privacy, consent, and data-minimization risk; in this skill context, that is especially dangerous because the input is real WhatsApp history and the metadata explicitly says explicit consent is required only for the person being cloned, not everyone else whose messages are being stored.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: Although described as a parser to extract messages by sender, the implementation accumulates and exports the full conversation, including all participants' messages. This functional broadening violates least privilege and purpose limitation, and in a digital-twin skill it materially increases sensitivity because unrelated participants' private speech may be ingested into downstream modeling or stored in artifacts.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger list contains broad phrases like 'persona,' 'simulate person,' and 'AI clone,' which can match ordinary conversation and invoke the skill unexpectedly. Because this skill processes highly sensitive interpersonal chat data and creates impersonation-like agents, accidental activation increases privacy and consent risk significantly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The privacy section says data should be processed locally except for the LLM API call, but it does not clearly warn users that intimate third-party chat content may be transmitted to an external model provider. This is dangerous because chat exports can contain personal, sensitive, and third-party data, and users may mistakenly believe the workflow is entirely local.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file instructs users to gather real personal messages across sensitive categories such as emotional moments, opinions, and work discussions, and to preserve them verbatim. Because the skill's purpose is to build a digital twin of a real person, omission of privacy and consent warnings makes the guidance more dangerous than a generic writing example: it facilitates ingestion of personally revealing data for imitation and potential deception.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly instructs collection of full identity, life context, relationships, living situation, and connection details from private chat history, but provides no built-in privacy minimization, consent verification workflow, or warning about the sensitivity of this data. In the context of a skill designed to create a digital twin of a real person, this materially increases the risk of invasive profiling, doxxing, impersonation, and non-consensual replication of someone's identity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions direct profiling of emotional patterns, triggers, frustrations, passions, complaints, and interpersonal dynamics, which are highly sensitive behavioral inferences derived from private communications. Because the skill's purpose is to simulate a real person, these sections enable creation of a psychologically rich dossier that can be used for manipulation, harassment, or highly convincing impersonation without warning users about those risks.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Mandating use of the person's native language without user choice reduces autonomy and can increase impersonation fidelity by making the synthetic persona sound more authentic to third parties. On its own this is a lower-severity issue, but in a digital-twin skill built from real chat exports it contributes to more convincing mimicry and misuse potential.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes sensitive chat contents to disk without any consent verification, warning, confirmation prompt, retention control, or privacy notice. In this skill context, that is more dangerous than a generic parser because the tool is explicitly meant to process intimate personal communications to emulate a real person, making accidental misuse, unauthorized cloning, and secondary disclosure more likely.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The file instructs the model to compile extensive personal, contextual, and relational details from chat messages into a reusable personality profile, effectively transforming raw private conversations into a persistent identity dossier. In a skill whose purpose is to clone a real person, this increases the harm surface beyond one-off summarization and supports impersonation, privacy invasion, and secondary misuse of highly identifying information.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Enumerating recurring phrases, emotional triggers, interests, complaints, humor style, and relationship dynamics creates a broad behavioral fingerprint that can be reused to imitate, manipulate, or socially engineer others. The danger is amplified by the surrounding digital-twin context, because these extracted patterns are not abstract analytics but instructions for reproducing a specific person's behavior and social identity.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: doppel
description: |
  Create AI digital twins of real people from WhatsApp chat history exports.
  Clone your friends, colleagues, or contacts into AI agents that talk, think, and react like them.
  Use when the user wants to: create a digital twin, clone a WhatsApp contact into an AI agent,
  build a persona from chat history, make an AI version of someone, create a doppelgänger agent,

• Confidence: 88% confidence
• Finding: Create AI digital twins of real people from WhatsApp chat history exports. Clone your friends, colleagues, or contacts into AI agents that talk, think, and react like them. Use when the user wants

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.