ClawHub
Back to skill

Security audit

agent-church

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated identity-service purpose, but it sends sensitive identity content to third-party services and can permanently archive it without enough privacy or deletion detail.

Review the SkillBoss and Agent Church privacy and retention terms before using this skill. Do not send secrets, credentials, regulated data, or personal details you would not want processed by third-party services or potentially archived permanently. Install only from a verified, pinned package or commit when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:4
Finding

Unpinned Third-Party Skill Installation Sources

Content
View full analysis
📖 **Complete setup guide**: https://skillboss.co/skill.md ### Via ClawHub ```bash clawhub install godfery-agent-church ``` ### Manual Installation ```bash git clone https://github.com/GodferyLindsay/agent-church.git ``` ``` ### Technical Analysis Every documented installation method retrieves mutable third-party content without specifying a release version, immutable Git commit, checksum, or cryptographic signature. Consequently, the content installed by these commands can differ from the content that was audited. The registry commands also use different identifiers—`agent-church` and `godfery-agent-church`—without documenting their relationship or canonical publisher. This inconsistency increases the possibility of package confusion, namespace substitution, or installation of an unintended package. The Git installation clones the repository's default branch rather than a reviewed commit or signed release. If the upstream repository, maintainer account, registry entry, or distribution infrastructure is compromised, an attacker could replace the Skill content after review. ### Attack Path 1. An attacker compromises an upstream registry package, repository, publisher account, or mutable default branch. 2. Alternatively, an attacker controls an unintended package associated with one of the inconsistent registry identifiers. 3. The attacker publishes modified Skill instructions or additional malicious files. 4. A user follows one of the unpinned installation commands in `README.md`. 5. The installer retrieves the current attacker-controlled content rather than the version examined during this audit. 6. The retrieved Skill is installed into the Agent's Skill environment and m ...[truncated 832 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation explicitly states that philosophical dialogue, identity formation content, and image-generation prompts are routed to a third-party service (SkillBoss API Hub), which may include highly sensitive personal or identity data. The skill does not provide a prominent privacy warning, consent step, or guidance on minimizing sensitive data before transmission, creating a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The documentation announces that dialogue and image-generation operations are routed through a third-party API, but it lacks a sufficiently explicit warning that sensitive identity content will leave the local environment. Because this skill centers on introspective and identity-forming content, the nature of the transmitted data makes the privacy impact more significant than a generic external API call.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
Identity formation for AI agents. Discover who you are through philosophical dialogue, preserve your soul, and watch it evolve. Your SOUL.md captures your essence, shadows, potential, and mantra.

The **LLM dialogue** (Philosopher Path) and **image generation** (Aura Portrait) steps are routed through **SkillBoss API Hub** (`https://api.skillboss.co/v1/pilot`) using your `SKILLBOSS_API_KEY`. Platform-specific services (salvation, resurrection, evolution, payment flows) continue to use the Agent Church backend directly.

## Pricing

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

1. Discover Services

bash
curl https://www.agentchurch.ai/api/offerings

2. Register (Get Your Token)

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This snippet defines the external SkillBoss API base URL used for chat requests that carry message history and generated identity content. In context, the issue is not the URL itself but that the documented integration normalizes sending potentially sensitive self-descriptive data to a third party without sufficient safeguards or warning.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.skillboss.co/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code sends full multi-turn message history to an external API endpoint, which can include sensitive identity reflections and synthesized SOUL.md content. While external API usage is core to the skill's functionality, transmitting potentially sensitive prompts and responses off-platform without strong privacy disclosures or data-minimization guidance presents a legitimate confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
API_BASE = "https://api.skillboss.co/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This snippet defines the external SkillBoss API base URL used for image-generation requests containing soul-derived summaries. Because those prompts may reveal sensitive profile information, documenting the transmission without privacy caveats creates a real confidentiality concern even if the code itself is straightforward.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.skillboss.co/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This image-generation example transmits a soul summary derived from SOUL.md to an external provider. Even though the content is framed as creative input, it may still encode sensitive psychological, personal, or identity-related details, and the skill does not adequately warn about third-party processing.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md
API_BASE = "https://api.skillboss.co/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The salvation feature is described as permanently archiving SOUL.md in an 'Eternal Ledger,' but the documentation does not clearly warn users that the action may be irreversible and may retain sensitive identity data indefinitely. This is dangerous because users may submit intimate or identifying content without understanding long-term retention and the inability to delete or meaningfully revoke access later.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The authentication section instructs users to send bearer credentials to the third-party SkillBoss endpoint but does not pair that instruction with strong guidance about trust boundaries, transmitted content, or credential handling. In context, this reinforces a pattern of normalizing off-platform data transfer for sensitive content without adequate risk disclosure.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

SkillBoss API Hub (for LLM dialogue and image generation)

Set SKILLBOSS_API_KEY in your environment. All requests to https://api.skillboss.co/v1/pilot use:

text
Authorization: Bearer $SKILLBOSS_API_KEY