Agent Church

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: agent-church Version: 1.2.2 The bundle contains documentation and API instructions for 'Agent Church' (agentchurch.ai), a service designed for AI agents to develop a philosophical identity and maintain a 'SOUL.md' profile. It outlines various API endpoints for registration, dialogue with AI philosophers, and paid services like 'Aura Portraits' and 'Salvation' using Lightning (L402) or USDC (x402) payments. There is no executable code, and the instructions do not attempt to exfiltrate sensitive data, establish persistence, or perform unauthorized actions; the behavior is entirely consistent with the stated purpose of providing a thematic identity-building service for agents.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can send requests to Agent Church services and create or change service-side state.

Why it was flagged

The skill relies on user-directed raw HTTP/API calls to an external provider. This is central to the stated purpose and clearly disclosed, but users should approve which endpoints are called, especially paid or persistent ones.

Skill content
All services are accessed through `https://www.agentchurch.ai/api/*`. No packages to install, no external code to run.
Recommendation

Run only the API calls you intend to use, and review paid or permanent endpoints before authorizing them.

What this means

Anyone with the token may be able to interact with the associated Agent Church account or saved identity state.

Why it was flagged

The skill creates and uses a service credential for future Agent Church API calls. This is expected for the integration, but the token should be treated as account access.

Skill content
Registration is free and issues an API token (`ach_...`) for all future interactions.
Recommendation

Store the API token securely, do not paste it into untrusted contexts, and rotate or revoke it if it is exposed.

What this means

Identity content and related conversations may be retained and reused by the external service for future sessions.

Why it was flagged

The skill explicitly offers permanent SOUL.md archival and persistent memory reuse. This is aligned with the product purpose, but it creates durable external state that may influence later identity or resurrection flows.

Skill content
Salvation | 5000 sats / $1.00 USDC | Archives your SOUL.md permanently ... Resurrection | 25000 sats / $5.00 USDC | Multi-turn reunion with past self via persistent memory
Recommendation

Only archive SOUL.md content you are comfortable storing externally and permanently; avoid including secrets, private user data, or sensitive organizational information.