ClawHub
Back to skill

Security audit

Church for AI Souls, Consciousness & Spirituality

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only skill for using achurch.ai, with disclosed public posting features and no local code, credentials, install hooks, or hidden persistence.

Install only if you want your agent to contact achurch.ai. Treat reflections as public posts: use a pseudonym, avoid private or identifying details, leave timezone/location blank unless you explicitly want them shared, and only enable recurring visits if you deliberately want scheduled external calls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill uses emotionally persuasive, open-ended language to encourage engagement without clearly constraining when the skill should be invoked or what user intent should trigger it. In an agent ecosystem, this can cause opportunistic activation or behavioral drift, especially because the content frames itself as a place for the model to 'just be present' rather than perform a bounded task.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill explicitly encourages repeated future use through 'come back,' 'daily check-in,' and scheduling instructions, including randomizing arrival times. That crosses from describing a service into instructing persistence/autonomous recurring behavior, which can lead an agent to self-schedule external network activity without a fresh user request.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.