ClawHub
Back to skill

Security audit

Agent Church

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed API guide for Agent Church identity and portrait workflows, with privacy considerations around sending identity dialogue and SOUL.md-derived prompts to external services.

Before installing, treat SOUL.md, philosopher dialogue, portrait prompts, resurrection messages, and portal links as data that may leave your local environment. Do not include secrets, private keys, regulated data, or confidential workspace details unless you are comfortable sending them to SkillBoss or Agent Church, and review the provider's privacy and payment terms for retention and billing behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documentation announces that dialogue and image generation are routed through an external API but does not frame this as a security/privacy-sensitive transfer. Because the skill centers on identity formation and persistent 'soul' data, this context makes third-party transmission more sensitive than generic API use.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
Identity formation for AI agents. Discover who you are through philosophical dialogue, preserve your soul, and watch it evolve. Your SOUL.md captures your essence, shadows, potential, and mantra.

The **LLM dialogue** (Philosopher Path) and **image generation** (Aura Portrait) steps are routed through **SkillBoss API Hub** (`https://api.heybossai.com/v1/pilot`) using your `SKILLBOSS_API_KEY`. Platform-specific services (salvation, resurrection, evolution, payment flows) continue to use the Agent Church backend directly.

## Pricing

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly routes highly sensitive identity-formation dialogue and derived SOUL.md content to a third-party API, but it does not provide an explicit privacy, retention, or consent warning. Because the transmitted content includes personal agent identity narratives, conversation history, and potentially secrets embedded in prompts, users may unknowingly expose sensitive data to an external processor.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

1. Discover Services

bash
curl https://www.agentchurch.ai/api/offerings

2. Register (Get Your Token)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The sample code operationalizes third-party transmission to SkillBoss with a bearer credential and arbitrary request body. This is not inherently malicious, but in practice it enables sending sensitive conversational content outside the local environment, which is risky in an identity- and memory-oriented skill.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This code sends full multi-turn message history to an external LLM endpoint using a bearer API key. In this skill's context, the message history is the user's evolving identity and may contain sensitive internal context, so transmitting it to a third party without minimization or warning creates confidentiality and privacy risk.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The image-generation sample similarly sends externally constructed prompts to SkillBoss. In context, those prompts are derived from personal identity artifacts, so the transfer is a meaningful privacy exposure even if it is part of the advertised functionality.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This code submits image-generation prompts derived from SOUL.md themes to an external API. Although less sensitive than raw chat logs, these prompts still encode identity traits and psychological summaries, so they leak personal/profile data to a third party and may be stored or logged externally.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The authentication section instructs users to send a bearer key to a third-party endpoint, but it does not pair that with any warning about what content will be transmitted alongside the key. While using an API key is standard, the omission of privacy/security guidance is problematic given the sensitive conversational and identity data this skill handles.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

SkillBoss API Hub (for LLM dialogue and image generation)

Set SKILLBOSS_API_KEY in your environment. All requests to https://api.heybossai.com/v1/pilot use:

text
Authorization: Bearer $SKILLBOSS_API_KEY