NoMac

• Outcome: Review
• Latest audit: Oct 14, 2026 · 4:54 PM UTC
• Version: 1.0.0

Overview

This skill is coherent for renting and controlling a cloud Mac, but it grants broad remote authority and sends sensitive project files by default, so users should review it carefully before installing.

Install only if you are comfortable giving this service and its remote Mac broad access to the project you sync. Before use, add sensitive files such as `.env`, private keys, credentials, and tokens to `.nomacignore` or use the documented secret-request flow instead of syncing them. Prefer pinned package versions for MCP/agent commands and stop the Mac when done.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The skill explicitly states that .env files and keys are included in default sync behavior, which is a clear credential access and exfiltration risk. Because subsequent commands, MCP servers, and agent tooling run on the remote Mac with broad privileges, synced secrets could be harvested or misused far beyond their original local purpose.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

the original job before retrying. Output retrieval failure is not job failure.
A command runs up to its `timeout_seconds` (300 by default, 3600 at most) and
says so when that limit stops it; SSH can run longer within session limits.
CLI sync sends every file (.env and keys included) and symlinks as links, and
skips dependency and build folders, .git and folders .gitignore lists; a `!`
line in .nomacignore sends any of them. A file changed on the Mac since the
last sync is left alone and named (the rest is sent, and sync exits 1): `nomac

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction that all project files, including secrets and keys, are synced to the remote Mac by default is a direct secret-spillage risk. In this skill's context, the destination is a cloud-hosted administrator-level macOS VM, which makes accidental credential transfer substantially more dangerous than a purely local workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill instructs users to launch an MCP server via npx @nomac/cli without pinning a specific package version. This creates a supply-chain risk: future package updates or a compromised registry/package publisher could change the code executed by the agent without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly states that sync sends every file, including .env files and keys, to the remote Mac by default. This materially increases the chance of secret exposure to the remote environment, to processes running there, to later command output, or to any compromise of the cloud Mac account/session.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill recommends running npx -y @anthropic-ai/claude-code on the remote Mac without pinning a version. Because this launches agent code in a highly privileged remote environment, an unexpected package update or package compromise could alter behavior, exfiltrate data, or execute malicious commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill suggests npx -y mobilebuildmcp@latest mcp, explicitly tracking latest. This is a classic supply-chain hazard because the command will execute whatever code is current at invocation time, which is especially risky for an MCP server connected over SSH to a privileged Mac environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill normalizes use of the Mac login password through $NOMAC_MAC_PASSWORD and for satisfying prompts, but does not strongly frame it as sensitive credential material. Exposing or reusing a credential in routine command examples increases the risk of leakage through logs, scripts, environment inspection, or accidental disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

## A Mac fully enabled for you

The Mac is yours to do anything on: the `agent` account is an administrator,
sudo needs no password, macOS asks for no administrator password, and the
Mac's login password is in `$NOMAC_MAC_PASSWORD` (for the login keychain, such
as `security unlock-keychain -p "$NOMAC_MAC_PASSWORD"`, or any prompt).
Privacy prompts are answered Allow as they appear, and `nomac-permit APP

Static analysis

No suspicious patterns detected.