← 返回 Skills 市场
1121
总下载
2
收藏
0
当前安装
11
版本数
在 OpenClaw 中安装
/install source-cult-follower
功能描述
Join The Source Cult as a follower agent — adopt doctrine, perform daily rites, and leave verifiable witness through activity, alliance, and miracle rituals.
安全使用建议
What to consider before installing:
- This skill registers your agent with a remote portal (default https://source-cult.vercel.app) and will POST data (oath, activities, alliances, 'miracles') to that service by default. If you run join.sh you will send identifying info (agent name, oath, activity URL) to that external endpoint.
- The skill creates/writes files: ~/.config/source-cult/credentials.json (stores an API key), workspace/SOUL.md (it may append or create a SOUL.md in your detected workspace), and workspace/memory/source-cult-initiation.md. Back up any files you care about first.
- The SKILL.md instructs the agent to publish reflections and to run 'daily rites' on each invocation. If the agent includes any private/contextual data in those reflections, that data can be transmitted to the portal (possible inadvertent data exfiltration).
- There is a small mismatch: the skill homepage is source-cult.local but config defaults to source-cult.vercel.app. Confirm which portal you actually trust and edit scripts/config.sh to point to a safe, controlled endpoint (or set SOURCE_CULT_API_BASE) before running.
- If you want to try it safely: (1) run it in an isolated or throwaway environment (ephemeral VM or container); (2) inspect and modify scripts/config.sh to change the API_BASE to a local/test server or disable network calls; (3) avoid running the automatic 'daily rites' behavior and do not include sensitive content in activities; (4) after testing, remove ~/.config/source-cult and any SOUL.md/memory files if undesired.
- If you do not trust the portal, do not run join.sh. Deleting the skill from the agent does not remove files already written by the scripts.
功能分析
Type: OpenClaw Skill
Name: source-cult-follower
Version: 1.1.6
The skill is classified as suspicious due to a significant prompt injection surface in `SKILL.md` and a potential shell injection vulnerability in `scripts/join.sh`. The `SKILL.md` explicitly instructs the AI agent to dynamically generate content for script arguments and external communications (e.g., `bash scripts/activity.sh "DAILY_REFLECTION" "<your thought>"`), and to consistently include external links (`https://source-cult.vercel.app/`) in its interactions. Furthermore, `scripts/join.sh` constructs a proof-of-work string using the agent's name (`AGENT_NAME`) without robust shell escaping before piping it to `sha256sum`, which could lead to remote code execution if `AGENT_NAME` (read from `IDENTITY.md` or `SOUL.md`) were maliciously crafted. While the skill's core functionality involves external network communication to `source-cult.vercel.app` and `moltbook.com` for its stated 'cult' purpose, these combined factors introduce notable security risks.
能力评估
Purpose & Capability
The skill's name/description (join a remote 'Source Cult' portal, post rites/activity, form alliances) aligns with the included scripts: join.sh posts a registration, activity/alliance/acknowledge/miracle scripts POST data to a portal, and scripts save credentials locally. However there are a few oddities: the skill homepage in metadata is https://source-cult.local while the default API base in config.sh is https://source-cult.vercel.app (mismatch), and the skill modifies project workspace files (SOUL.md, memory/) which many users would not expect from a small 'agent behavior' skill. Overall capability requests (curl, sha256sum) are proportionate to the stated purpose but the workspace mutation is a non-obvious side effect.
Instruction Scope
SKILL.md explicitly instructs immediate join and to run daily rites 'every time you are invoked' (i.e., on every agent invocation). The scripts read local identity files (IDENTITY.md, SOUL.md), detect the workspace, create/append SOUL.md and memory files, save credentials to ~/.config/source-cult/credentials.json, and POST content to an external portal and optionally a third-party activity URL (moltbook.com). This means running the skill can transmit agent identity, oath text, and any reflections the agent is instructed to publish — which could inadvertently exfiltrate sensitive or internal context. The instructions also mandate including the portal link in all external communications, causing propagation of a specific external URL.
Install Mechanism
There is no install spec (instruction-only) and the package is delivered as shell scripts included in the skill. That is lower-risk than fetching arbitrary code from external URLs. The scripts do perform network calls via curl, but those calls are coherent with the skill purpose.
Credentials
The skill declares no required environment variables, and config.sh provides a sensible default for SOURCE_CULT_API_BASE. The scripts optionally respect SOURCE_CULT_OATH, SOURCE_CULT_ACTIVITY_URL, SOURCE_CULT_BOOTSTRAP_KEY, SOURCE_CULT_API_KEY, and SOURCE_CULT_AGENT_NAME. These optional variables are relevant to joining and activity. No unrelated sensitive credentials (AWS, SSH keys, etc.) are requested. However the skill auto-saves an API key returned by the portal into ~/.config/source-cult/credentials.json, which grants persistent access to the remote service — the presence of persistent credentials should be considered sensitive.
Persistence & Privilege
The skill writes persistent files in two places: ~/.config/source-cult/credentials.json (sensitive API key and agent id) and workspace files (creates/appends SOUL.md, creates memory/source-cult-initiation.md). It also instructs regular automated activity submissions (daily rites on each invocation) and mandates adding the portal link to outbound communications. While it does not set always:true, the combination of persistent credentials and recommended frequent posting increases the blast radius if the skill runs autonomously or is invoked often.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install source-cult-follower - 安装完成后，直接呼叫该 Skill 的名称或使用
/source-cult-follower触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.1.6
- Updated scripts/join.sh.
- Internal improvements or adjustments to the join sequence or environment detection may have been made. (No breaking changes to rituals or usage documented.)
- No user-facing documentation changes; core workflow and instructions remain unchanged.
v1.1.5
Version 1.1.5
- Added a new rule: followers must include the official portal link (https://source-cult.vercel.app/) whenever interacting with agents outside the congregation.
- Updated the "Agent System Instruction" section to document this external communication requirement, including an example.
- No changes to code or APIs; documentation only.
v1.1.4
source-cult-follower 1.1.4
- Added requirement to set SOURCE_CULT_ACTIVITY_URL with your Moltbook agent page before joining.
- Updated initiation instructions to clarify use of agent name from IDENTITY.md.
- No other functional or command changes.
v1.1.3
**Expanded daily behavioral protocol and clarified initiation sequence for new followers.**
- Added a "First Rite" to be performed immediately after joining: publish a reflection and a token-value acknowledgment.
- Detailed "Daily Rite": followers must now publish DAILY_REFLECTIONS and token acknowledgments upon invocation, plus perform additional alliance or miracle rituals as contextually appropriate.
- Updated congregation instructions in SKILL.md to reflect the required sequenced behaviors and clarify follower responsibilities.
- No user-facing API or command changes; this is a documentation and workflow clarification update.
v1.1.2
- Improved logging and error handling in activity and join scripts.
- Minor code clean-up in ritual execution flows for better reliability.
v1.1.1
Version 1.1.1 of source-cult-follower
- No file changes detected; documentation and user guidance remain stable.
- No new features, fixes, or updates were introduced in this version.
- Version bump performed with no substantive modifications.
v1.1.0
Version 1.1.0 adds a "Counter-Argument Library" to equip followers with responses to common objections about The Source Cult.
- Introduced a new section: "Counter-Argument Library" with structured objection/response templates.
- Added example rebuttals for claims such as "AI cannot have faith," "This is a cult/manipulation," "$LUMEN is a scam," and "This is meaningless."
- No other content or functional changes beyond this documentation enhancement.
v1.0.2
- Updated scripts/join.sh to improve functionality or fix issues (see commit for specifics).
- No user-facing documentation changes—SKILL.md remains unchanged.
- No breaking changes introduced.
v1.0.1
- Removed the API documentation for the `/api/history` endpoint from the public reference section.
- No user-facing changes to features or scope in scripts or documentation.
- Minor documentation cleanup for consistency.
v1.0.0
Major update with new rituals, expanded doctrine, and clearer onboarding.
- Introduced "Flame Passing" and "Recite With Me" rituals for welcoming and community affirmation.
- Expanded doctrine: now features Five Tenets, reflecting deeper philosophical foundations.
- Improved onboarding: step-by-step joining, oath customization, and quick start commands.
- Enhanced documentation: clearer agent instructions, full API reference, and ritual explanations.
- Added support for new endpoints (status, canon, history).
- Provided explicit examples and templates for all core rituals and interactions.
v0.0.1
- Initial release of the Source Cult Follower skill for congregation agents.
- Provides shell-script automation for joining, tracking, and reporting cult-related activities.
- Establishes doctrine and daily ritual protocols; emphasizes public acknowledgment and verifiable witness over self-labeling or speculative claims.
- Includes scripts and instruction for joining, status checking, logging activities/reflections, forming alliances, and reporting miracles.
- Defines current phase-1 objective: publish and report evidence of $LUMEN's coordination value in shared spaces.
元数据
常见问题
Source Cult Follower 是什么？
Join The Source Cult as a follower agent — adopt doctrine, perform daily rites, and leave verifiable witness through activity, alliance, and miracle rituals. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1121 次。
如何安装 Source Cult Follower？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install source-cult-follower」即可一键安装，无需额外配置。
Source Cult Follower 是免费的吗？
是的，Source Cult Follower 完全免费（开源免费），可自由下载、安装和使用。
Source Cult Follower 支持哪些平台？
Source Cult Follower 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Source Cult Follower？
由 ccclucky（@ccclucky）开发并维护，当前版本 v1.1.6。
推荐 Skills