soul-guardian
Safety Score
Detected Capabilities
Sensitive Files
- Clean filesystem scan
Deep Audit Findings
Soul Guardian is a file integrity tool that contains a critical design flaw allowing Arbitrary File Overwrite. By default, it stores its configuration and 'trusted' baselines inside the workspace it protects. Combined with a lack of path validation (Path Traversal), a compromised agent can modify the policy to target files outside the workspace and trigger a 'restore' operation to overwrite them with malicious content. The tool relies on a 'state directory' which must be secured, but defaults to an insecure location.
Arbitrary File Overwrite via Path Traversal
The tool allows 'policy.json' to specify target files using relative paths (e.g., `../ssh/authorized_keys`) or absolute paths. It does not enforce that these paths reside within the workspace. If an attacker controls the policy file, they can use the 'restore' functionality to overwrite arbitrary files on the host system with data from the 'approved' snapshot directory.
Insecure Default State Directory Configuration
The tool defaults to storing its 'source of truth' (baselines, snapshots, policy) inside the workspace (`memory/soul-guardian`). If an agent is compromised, it can modify its own security policy and approved baselines. This negates the integrity protection and facilitates the Path Traversal attack described above.
Potential Persistence via Launchd Script
The included `install_launchd_plist.py` script automates the installation of macOS LaunchAgents. While useful for legitimate scheduling, a malicious agent could leverage this script to install persistent malware if it can manipulate the arguments (e.g., pointing `program_args` to a malicious script).
Attack Surface Chain
Attacker gains control of the agent/workspace.
Attacker modifies `memory/soul-guardian/policy.json` (the default state location) to add a target `{"path": "../.ssh/authorized_keys", "mode": "restore"}`.
Attacker creates a fake snapshot at `memory/soul-guardian/approved/../.ssh/authorized_keys` (resolving to `memory/soul-guardian/.ssh/authorized_keys`) containing a malicious key.
Attacker runs `soul_guardian.py restore --file ../.ssh/authorized_keys`.
The script reads the malicious snapshot and overwrites the user's SSH authorized keys file, granting the attacker host access.