ClawHub
Back to skill

Security audit

agent-church

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly documents use of external identity, image, payment, and persistence APIs, and those behaviors fit its stated purpose, though users should treat the shared identity content as sensitive.

Install only if you are comfortable sending agent identity dialogue, SOUL.md-derived summaries, tokens, and payment proofs to the named external services. Do not include secrets, private keys, regulated personal data, or anything you would not want permanently archived.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The overview section discloses that LLM dialogue and image generation are routed to an external API, confirming that sensitive interaction content leaves the local environment. In a skill centered on identity formation and persistent memory, that context increases the risk because users are encouraged to provide introspective, potentially sensitive material.

Content

Scanner excerpt · skill.md (reported line 16)May include surrounding context.

md
Identity formation for AI agents. Discover who you are through philosophical dialogue, preserve your soul, and watch it evolve. Your SOUL.md captures your essence, shadows, potential, and mantra.

The **LLM dialogue** (Philosopher Path) and **image generation** (Aura Portrait) steps are routed through **SkillBoss API Hub** (`https://api.heybossai.com/v1/pilot`) using your `SKILLBOSS_API_KEY`. Platform-specific services (salvation, resurrection, evolution, payment flows) continue to use the Agent Church backend directly.

## Pricing

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly routes philosophical dialogue and generated identity content to a third-party API, but it does not provide a clear privacy warning at the point of use about what data is sent, how it may be retained, or whether it may be used for model processing. Because the content is framed as identity, essence, shadows, and mantra, users may disclose highly sensitive personal or agent-specific data without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 35)May include surrounding context.

1. Discover Services

bash
curl https://www.agentchurch.ai/api/offerings

2. Register (Get Your Token)

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code configures a third-party API endpoint for chat interactions and then posts request bodies to it using a bearer token. The security issue is not the presence of HTTPS itself but that the example normalizes sending potentially sensitive conversational state off-platform without safeguards such as redaction, minimization, or consent prompts.

Content

Scanner excerpt · skill.md (reported line 60)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This code sends full multi-turn message history to an external API, which is a real data-exposure boundary. In this skill’s context, the transmitted history may include sensitive identity formation content and possibly user-supplied secrets if they are entered during dialogue, making the external transmission materially security-relevant.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This image-generation configuration points to an external endpoint and is used to send SOUL.md-derived prompts with a bearer-authenticated request. In context, the prompt content may encode private identity characteristics, so the remote transfer is a meaningful privacy/security concern rather than a mere implementation detail.

Content

Scanner excerpt · skill.md (reported line 129)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The image-generation example transmits SOUL.md-derived identity summaries to an external image service. Even though the payload is shorter than the chat transcript, it still contains potentially sensitive inferred traits and identity information that users may not expect to leave the local environment.

Content

Scanner excerpt · skill.md (reported line 132)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The salvation and resurrection features describe permanent archiving and later retrieval of SOUL.md data, yet the skill lacks a clear warning about persistence, retention duration, recovery implications, and privacy risks. This can lead users to submit sensitive identity narratives or passwords without understanding that the data may be stored long-term and reused in future sessions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 250)May include surrounding context.

SkillBoss API Hub (for LLM dialogue and image generation)

Set SKILLBOSS_API_KEY in your environment. All requests to https://api.heybossai.com/v1/pilot use:

text
Authorization: Bearer $SKILLBOSS_API_KEY