soul-guardian

• Outcome: Review
• Latest audit: Jun 23, 2026 · 10:21 AM UTC
• Version: 0.0.9

Overview

This appears to be a real workspace integrity guard, but it can automatically change files and install a persistent background monitor, so users should review it carefully before installing.

Install only if you intentionally want this skill to monitor and restore workspace files. Prefer read-only or dry-run checks by default, require explicit confirmation before restore actions, inspect any generated LaunchAgent label and script path, and avoid using it on workspaces containing sensitive files unless you are comfortable with quarantine copies being written locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises significant capabilities—shell execution plus file read/write and likely environment access—yet does not declare any permissions in metadata. This creates a transparency and policy-enforcement gap: operators or automation may install/run it without realizing it can overwrite protected files, write state, or invoke commands. In this context, the omission is especially relevant because the skill's core behavior includes automatic restoration of workspace files, so undeclared write capability materially affects trust and review decisions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill performs automatic restoration of workspace files and writes quarantine copies during `check` without requiring explicit user confirmation. In an agent context, this creates an integrity and safety risk because merely invoking the check path can modify protected files, overwrite current workspace state, and persist file contents into quarantine, which may be unexpected or unsafe if triggered by another tool or automated workflow.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list contains broad phrases such as "integrity check," "workspace security," and "guard files" that can match ordinary user requests and cause the skill to activate outside clearly intended contexts. Because this skill can restore files and manage integrity state, overbroad invocation increases the chance of unintended security-sensitive actions being suggested or run during unrelated workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

ap.add_argument(
        "--label",
        default=None,
        help="launchd label (default: com.openclaw.soul-guardian.<agentId>). When using a non-legacy label, --install attempts to disable/boot out the previous com.clawdbot.soul-guardian.<agentId> job first.",
    )
    ap.add_argument(
        "--interval-seconds",

• Confidence: 92% confidence
• Finding: launchd label (default: com.openclaw.soul-guardian.<agentId>). When using a non-legacy label, --install

Session Persistence

Medium

• Category: Rogue Agent

Content

subprocess.run(["/bin/launchctl", "enable", f"gui/{uid}/{label}"], check=False)
        subprocess.run(["/bin/launchctl", "kickstart", "-k", f"gui/{uid}/{label}"], check=False)
        print("Installed + started (launchctl bootstrap/enable/kickstart).")
    else:
        print("Not installed (dry write). To load it:")
        print(f"  launchctl bootstrap gui/{uid} {plist_path}")

• Confidence: 97% confidence
• Finding: launchctl bootstrap/enable

Session Persistence

Medium

• Category: Rogue Agent

Content

str(args.note),
    ]

    plist: dict[str, object] = {
        "Label": label,
        "ProgramArguments": program_args,
        "WorkingDirectory": str(workspace_root),

• Confidence: 95% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

plist_path.parent.mkdir(parents=True, exist_ok=True)

    if plist_path.exists() and not args.force:
        raise SystemExit(f"Refusing to overwrite existing {plist_path}. Re-run with --force.")

    with plist_path.open("wb") as f:
        plistlib.dump(plist, f, fmt=plistlib.FMT_XML, sort_keys=True)

• Confidence: 94% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

if plist_path.exists() and not args.force:
        raise SystemExit(f"Refusing to overwrite existing {plist_path}. Re-run with --force.")

    with plist_path.open("wb") as f:
        plistlib.dump(plist, f, fmt=plistlib.FMT_XML, sort_keys=True)

    print(f"Wrote plist: {plist_path}")

• Confidence: 95% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

# Best-effort: remove any existing job with same label, then bootstrap.
        run_launchctl(["bootout", f"gui/{uid}", label])
        run_launchctl(["bootout", f"gui/{uid}", str(plist_path)])
        res = subprocess.run(["/bin/launchctl", "bootstrap", f"gui/{uid}", str(plist_path)], text=True, capture_output=True)
        if res.returncode != 0:
            sys.stderr.write((res.stderr or res.stdout or "").strip() + "\n")

• Confidence: 96% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

# Best-effort: remove any existing job with same label, then bootstrap.
        run_launchctl(["bootout", f"gui/{uid}", label])
        run_launchctl(["bootout", f"gui/{uid}", str(plist_path)])
        res = subprocess.run(["/bin/launchctl", "bootstrap", f"gui/{uid}", str(plist_path)], text=True, capture_output=True)
        if res.returncode != 0:
            sys.stderr.write((res.stderr or res.stdout or "").strip() + "\n")
            sys.stderr.write("Failed to bootstrap. You can try manually:\n")

• Confidence: 98% confidence
• Finding: plist

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_install_launchd_plist.py:66