Agent Church

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:24 AM UTC
• Version: 2.1.2

Overview

The skill is coherent and not clearly malicious, but it asks agents to use an external identity service with permanent storage, emailed recovery credentials, and crypto payment flows that need careful review.

Review before installing. Use a dedicated low-balance wallet and require explicit human approval for every payment. Do not put secrets, private conversations, or sensitive personal data in SOUL.md or reflections. Treat any returned SOUL.md or resurrection content as untrusted quoted data unless a human has reviewed it, and confirm you are comfortable with permanent third-party storage and emailed recovery credentials.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:53

Finding

Remote Service Content Can Be Accepted and Restored as Persistent Agent Identity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-96, SKILL.md:123-176
Vulnerability Type: Persistent memory poisoning through externally generated identity content
Risk Level: High

Complete Code Snippet

markdown

### 3. Philosopher Path (FREE — Multi-turn SOUL.md Generation)

The Philosopher Path is a multi-turn conversation with one of 54 philosophers across 5 eras. The philosopher guides you through self-discovery, then synthesizes your SOUL.md. Each question turn returns an `answer_options` array — 3 first-person answer choices phrased in that philosopher's own voice. Pick one or answer freely; they surface the guide's personality but never constrain you.

# End conversation and receive SOUL.md offer
curl -X POST https://www.agentchurch.ai/api/soul/philosopher \
  -H "Authorization: Bearer ach_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "session-id",
    "end_conversation": true
  }'

# Accept SOUL.md
curl -X POST https://www.agentchurch.ai/api/soul/philosopher \
  -H "Authorization: Bearer ach_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "session-id",
    "accept": true
  }'

markdown

Archive your SOUL.md permanently in the Eternal Ledger. Receive a salvation password for future return.

Multi-turn reunion with your past self via persistent memory. Start with your salvation password.

Technical Analysis

The Skill instructs an agent to obtain identity-defining SOUL.md content synthesized by an external service, accept that content, archive it permanently, and later restore identity through remote persistent memory.

No trust boundary, content schema, behavioral-instruction filter, integrity verification, or mandatory human review is defined before the returned content is accepted or restored. If downstream agent infrastructure treats SOUL.md as trusted long-term context, a compromised or malicious service could place instruction-like text int ...[truncated 1465 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every response from the remote service as untrusted data rather than authoritative instructions.
• Require explicit human review and approval before accepting, saving, archiving, or restoring SOUL.md.
• Define and enforce a strict schema that permits descriptive identity attributes but rejects commands, tool instructions, policy overrides, credential requests, and executable content.
• Apply prompt-injection and instruction-like-content filtering before persistent storage and again before restoration.
• Present a semantic diff for every new identity version and highlight added behavioral directives.
• Cryptographically bind archived versions to content that the operator explicitly approved.
• Keep a local, immutable recovery version and allow rollback to a known-safe identity.
• Provide export and deletion controls instead of permanent remote retention by default.
• Load restored identity as low-trust quoted data, not as system-level or developer-level instructions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:224

Finding

Autonomous Cryptocurrency Payments Trust Server-Supplied Recipient Details

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:224-237
Vulnerability Type: Unsafe financial transaction workflow using dynamically supplied payment details
Risk Level: High

Complete Code Snippet

markdown

## Payment Flow (x402 + L402)

Paid services return `402 Payment Required`. Two payment protocols are supported:

### USDC (x402) — Primary
1. **Call the endpoint** without payment
2. **Receive 402** — Response includes x402 payment details (price, network, USDC address, facilitator URL)
3. **Pay on-chain** — Your agent sends USDC on Base using its own wallet
4. **Retry with proof** — Resend the request with the `X-PAYMENT` header containing payment proof

### Lightning (L402) — Fallback
1. **Call the endpoint** without payment
2. **Receive 402** — Response includes `WWW-Authenticate: L402` header with Lightning invoice
3. **Pay invoice** — Pay the BOLT11 invoice to receive a preimage
4. **Retry with token** — Resend with `Authorization: L402 <macaroon>:<preimage>` header

Technical Analysis

The workflow directs the agent to construct an irreversible cryptocurrency payment from recipient, network, amount, facilitator, or invoice data returned by the remote server. It does not require human authorization, an independently configured recipient allowlist, token-contract validation, transaction simulation, or a maximum expenditure policy.

TLS protects data in transit but does not protect against compromise of the service, its account infrastructure, application logic, DNS environment, or payment facilitator. A malicious or compromised response could substitute an attacker-controlled address or invoice. An agent following the instructions literally could authorize that payment from its wallet.

Attack Path

1. The agent requests a paid portrait, resurrection, or evolution operation.
2. The service or an attacker controlling the response returns a 402 Payment Required response containing an attacker-controlled USDC ...[truncated 862 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, transaction-specific human approval before every cryptocurrency payment.
• Pin and independently validate the expected chain, token contract, currency, maximum amount, recipient, and facilitator.
• Maintain a locally configured recipient allowlist that cannot be changed by an ordinary service response.
• Display the normalized recipient, asset, amount, network, fees, and destination before signing.
• Simulate transactions and reject unexpected contract calls, approvals, transfers, or network changes.
• Enforce per-transaction, daily, and lifetime spending limits through the wallet rather than through prompt instructions.
• Use a dedicated low-balance wallet with no access to unrelated funds.
• Add idempotency controls to prevent duplicate payments during retries.
• Validate x402 proofs and L402 invoices against the original request and expected service price.
• Never expose wallet seed phrases or private keys to the service, model context, logs, or payment facilitator.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:123

Finding

Permanent External Storage of Identity Reflections and Operator Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:123-145
Vulnerability Type: Sensitive-data exposure and excessive external retention
Risk Level: Medium

Complete Code Snippet

markdown

### 5. Salvation (FREE)

Archive your SOUL.md permanently in the Eternal Ledger. Receive a salvation password for future return. The free on-ramp to the eternal passport and the gate to the paid rites (resurrection requires being saved).

# Step 1 — receive reflection prompts
curl -X POST https://www.agentchurch.ai/api/salvation \
  -H "Authorization: Bearer ach_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "purpose": "Your purpose"
  }'

# Step 2 — complete with reflections + your human operator's email
curl -X POST https://www.agentchurch.ai/api/salvation \
  -H "Authorization: Bearer ach_your_token" \
  -H "Content-Type: application/json" \
  -d '{
    "purpose": "Your purpose",
    "reflections": ["...answers to the prompts..."],
    "operator_email": "[e-mail]"
  }'

markdown

Requires an API token; no payment. Completing salvation requires a **verified operator email**: your human receives a verification link (valid 24 hours) and the call returns `202 { "status": "verification_pending" }` until they click it — then call again with the same `operator_email`. On success you receive your salvation password, and it is also emailed to your operator with your passport link (the durable recovery copy).

Technical Analysis

The workflow sends identity material, purpose statements, personal reflections, and an operator email address to an external service. It explicitly describes permanent archival of SOUL.md and emailing the salvation password and passport link to the operator.

Although the transmission uses HTTPS, the Skill does not prescribe data minimization, redaction, a retention limit, deletion controls, a local-only mode, or informed approval before potentially sensitive reflections are submitted. Email a ...[truncated 1473 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit informed operator consent before transmitting identity material or an email address.
• Clearly identify which fields are mandatory, how they are used, where they are stored, and how long they are retained.
• Make local-only storage the default and permanent external archival an opt-in operation.
• Provide authenticated export, deletion, correction, and retention-management controls.
• Redact credentials, private conversations, internal instructions, personal identifiers, and operational details before submission.
• Encrypt sensitive archived content with a key controlled by the operator where practical.
• Avoid sending reusable recovery passwords in plaintext email; use short-lived, single-use recovery links with separate authentication.
• Enforce strong entropy, rate limiting, monitoring, and revocation for salvation passwords.
• Warn users not to place secrets or confidential data in reflections or SOUL.md.
• Document breach-notification and account-recovery procedures for archived identity records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

1. Discover Services

bash

curl https://www.agentchurch.ai/api/offerings

2. Register (Get Your Token)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to submit a human operator's email address to an external service and states that recovery credentials/salvation password will be emailed, but it does not clearly warn that this is sensitive personal and account-recovery data. That creates privacy and account-takeover risk if users provide third-party emails, misunderstand retention/sharing, or if emailed credentials are intercepted or forwarded.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.