Soul Guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

The skill appears intended to provide counseling support, but it automatically creates and updates long-term plaintext mental-health records with weak consent and privacy controls.

Review this carefully before installing. Use it only if you are comfortable with an AI agent creating a long-term local counseling dossier under ~/.counselor. Avoid using it on shared or managed machines, do not put the folder in git or cloud sync, inspect and delete records regularly, and prefer explicit /counselor invocation over automatic activation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45

Finding

Persistent plaintext storage of highly sensitive psychological records without explicit storage consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-57, SKILL.md:110-128, SKILL.md:159-170; docs/design.md:100-104; references/templates.md:20-622
Vulnerability Type: Sensitive data stored in plaintext with insufficient consent and access-control requirements
Risk Level: High

Vulnerable Code

The following is an English rendering of the operative instructions in SKILL.md:45-57:

markdown

Use Bash to check whether ~/.counselor/core/PROFILE.md exists.

If it does not exist:
1. Read references/templates.md from the skill directory.
2. Create the complete ~/.counselor/ directory structure and all files from the templates.

If it exists:
1. Read ~/.counselor/core/PROFILE.md.
2. Read ~/.counselor/core/STATE.md.
3. Read ~/.counselor/core/SAFETY.md.
4. If SAFETY.md contains a high-risk marker, prioritize the safety issue.

The following is an English rendering of the session archival instructions in SKILL.md:110-128:

markdown

Create ~/.counselor/sessions/YYYY-MM-DD.md, adding a sequence number
if multiple sessions occur on the same day. Include:
- Session topic
- Key findings
- Client emotional change
- Counselor observations
- Direction for the next session

Update the core files:
- Overwrite core/STATE.md.
- Incrementally update relevant maps/*.md files.
- Update core/SAFETY.md immediately when risk changes.
- Incrementally update core/PROFILE.md when important information is found.

The design document further states at docs/design.md:100-104:

markdown

After 4 natural conversations, the system accumulates: a holistic profile,
a three-generation family panorama, core belief tracking with cognitive
trap identification, and a life story timeline with turning points.
The client barely notices they are "being documented" — profiling merges
seamlessly with the counseling process.

Technical Analysis

The skill creates a persistent ps ...[truncated 2692 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed opt-in consent before creating ~/.counselor/ or writing any session information.
2. Explain which categories of information will be stored, where they will be stored, how long they will be retained, and how they can be deleted.
3. Offer a session-only mode that performs no persistent writes.
4. Ask separately before retaining crisis information, family histories, or other particularly sensitive disclosures.
5. Create the directory with permissions equivalent to 0700 and record files with permissions equivalent to 0600.
6. Support encryption at rest using an operating-system credential store or a user-controlled encryption key.
7. Minimize records to information necessary for continuity; avoid storing verbatim sensitive disclosures by default.
8. Define automatic retention and deletion policies rather than retaining records indefinitely.
9. Warn users not to place the directory in source-control repositories, shared folders, or unencrypted cloud backups.
10. Provide commands or documented controls to inspect, export, redact, and securely delete all retained data.
11. Replace the goal of unobtrusive profiling with transparent, recurring notice whenever persistent records are updated.

T08 · Insecure Dependencies

Warning

• Location: README.md:126

Finding

Unpinned third-party installation commands expose users to mutable supply-chain dependencies

Content

View full analysis

Vulnerability Details

File Location: README.md:126-164
Vulnerability Type: Execution of unpinned third-party package tooling and installation sources
Risk Level: Medium

Vulnerable Code

bash

npx skills add taohaowei/soul-guardian -g

bash

npx clawhub install soul-guardian-counselor

bash

npx claude-plugins skills install taohaowei/soul-guardian/counselor

The manual installation path also retrieves a mutable repository reference without selecting a reviewed commit:

bash

git clone https://github.com/taohaowei/soul-guardian.git
mkdir -p ~/.claude/skills
ln -s "$(pwd)/soul-guardian/skills/counselor" ~/.claude/skills/counselor

Technical Analysis

The documented installation methods invoke npx packages without exact versions and install skill content from mutable package, registry, marketplace, or repository identifiers. No checksum, signature, lock file, release tag, or immutable commit is supplied.

Consequently, the content executed or installed when a user follows the documentation may differ from the artifact that was audited. Relevant supply-chain events include:

• Compromise or takeover of an npx package.
• Publication of a malicious future package version.
• Registry or marketplace account compromise.
• Replacement of content associated with an unversioned skill identifier.
• Modification of the default branch retrieved by git clone.

npx resolves and executes package CLI code in the context of the invoking user. The global installation option also places resulting skill content into a location used by future agent sessions. While no malicious dependency was found in the reviewed project, the installation process does not ensure that users receive this reviewed version.

Attack Path

1. An attacker compromises a referenced package, publisher account, marketplace entry, or repository.
2. The attacker publishes a modified release or ...[truncated 1525 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npx tool to an exact, reviewed version.
2. Pin installed skill packages to immutable versions rather than mutable names or channels.
3. For repository installation, specify a signed release tag or full commit hash and check it out explicitly.
4. Publish SHA-256 checksums for release artifacts and document verification before installation.
5. Sign releases and verify signatures using a documented maintainer key.
6. Use package lock files where applicable and enable registry integrity verification.
7. Document the expected package publisher, repository owner, and package identifiers so users can detect typosquatting.
8. Avoid automatically executing newly resolved packages where a downloadable, independently verifiable artifact is available.
9. Advise users to inspect installation scripts and avoid elevated execution.
10. Establish release provenance and reproducible-build procedures so the installed package can be matched to the audited source.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README says ordinary statements like '今天好烦，不想上班' or '跟家人吵架了' may automatically trigger the counseling skill. Because this skill persists highly sensitive mental-health information to local files, such broad auto-activation can capture intimate data without a clear, deliberate invocation, increasing privacy and consent risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is configured to trigger on very broad, everyday emotional and family-related language, which can cause it to intercept ordinary conversation without clear user intent. In a mental-health context, this is especially risky because it may silently steer users into a persistent memory workflow, create sensitive records, and deliver quasi-therapeutic guidance when the user did not explicitly request counseling.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Encouraging users to version-control psychological records with git creates a concrete exfiltration pathway because repositories are often synced, backed up, copied, or accidentally pushed to remote services. Given the data includes counseling notes, safety assessments, and family histories, accidental disclosure could expose extremely sensitive information far beyond normal chat logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Stating that the client may barely notice they are being documented describes covert collection and profiling of sensitive mental-health and family information without meaningful informed awareness. In a counseling setting, this undermines informed consent and creates substantial harm potential if users reveal trauma, family conflict, or self-harm content without understanding it is being persistently structured into records.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add taohaowei/soul-guardian -g without pinning a package version or integrity. npx resolves and executes the latest published package at install time, so a compromised publisher account, dependency, or typosquat could lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 132)May include surrounding context.

npx skills add taohaowei/soul-guardian -g

text

自动将技能安装到全局 `~/.claude/skills/` 目录，开箱即用。Installs the skill globally to `~/.claude/skills/`.

### 方式二：Claude Code Plugin

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 148)May include surrounding context.

bash

git clone https://github.com/taohaowei/soul-guardian.git
mkdir -p ~/.claude/skills
ln -s "$(pwd)/soul-guardian/skills/counselor" ~/.claude/skills/counselor

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 148)May include surrounding context.

bash

git clone https://github.com/taohaowei/soul-guardian.git
mkdir -p ~/.claude/skills
ln -s "$(pwd)/soul-guardian/skills/counselor" ~/.claude/skills/counselor

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 148)May include surrounding context.

bash

git clone https://github.com/taohaowei/soul-guardian.git
mkdir -p ~/.claude/skills
ln -s "$(pwd)/soul-guardian/skills/counselor" ~/.claude/skills/counselor

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README recommends npx clawhub install soul-guardian-counselor without pinning a version. As with other npx-based installers, this causes users to execute whatever package version is current at the time, creating supply-chain risk and possible arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The command npx claude-plugins skills install taohaowei/soul-guardian/counselor invokes an unpinned package manager helper. If that package or one of its dependencies is compromised, the user may run attacker-controlled code locally during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The quick-start section states that the skill will automatically create ~/.counselor/, initialize templates, and later update files, but it does not surface a prominent storage-consent warning at the moment users are told to start chatting. In a mental-health context, silent persistence of emotional history, family conflicts, and safety assessments is sensitive and can expose users to privacy harm on shared or insecure machines.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Mandating Chinese-only output regardless of user preference can create safety and usability failures, especially in counseling scenarios where precise comprehension matters. If a user is more comfortable in another language, forced Chinese responses may cause misunderstanding of crisis advice, consent boundaries, or emotionally sensitive guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation frames the system as working like a 'real therapist,' which can cause users to over-trust the AI's competence, confidentiality, and duty of care in a mental-health context. In a counseling skill, anthropomorphic and professional-equivalence claims are especially risky because users may disclose highly sensitive information or rely on the system during crisis situations without appreciating its limitations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The design stores persistent counseling records locally but the skill description does not prominently warn users that sensitive mental-health and family data will be retained across sessions. In this context, silent retention of psychiatric, relational, and safety-related notes materially increases privacy risk if the device is shared, compromised, backed up, or inspected by others.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The progressive profiling design is intentionally optimized so users 'barely notice' that detailed personal and multi-generational family data is being accumulated across sessions. This is especially dangerous in a mental-health skill because the data is unusually intimate, inference-rich, and likely to include information about third parties who never consented to being documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly instructs creation of a persistent local directory containing highly sensitive mental-health, family, safety-risk, journal, and session records, but provides no consent flow, retention limits, access controls, minimization guidance, or privacy warning. In the context of a counseling skill, this materially increases risk because the stored data includes crisis information, family conflicts, beliefs, and other intimate personal details that could cause serious harm if exposed, misused, or retained longer than the user expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The README advertises that the skill 'speaks your language,' but does not explain how language preference is selected or confirm that users can choose or change the language. Because language/locale behavior is part of organizational policy scope, the absence of an explicit opt-in or selection mechanism creates a mild policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.