ClawHub
Back to skill

Security audit

macOS Health Check

Security checks for vulnerabilities and agentic risk

Overview

The skill is rated benign with medium confidence: the scanners found no AIG issues and the reported matches appear consistent with its stated read-only health-check guidance, though coverage is partial.

The verdict is benign, but confidence is medium and Skillspector coverage is partial because several local path-like references could not be resolved. Consider that uncertainty before installing; the scan does not establish that the skill is risk-free.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
exists before and is gone after (`[ -e "<path>" ]`). If `trash` fails, stop and ask.
6. **Backup before larger cleanup.** Before removing anything beyond caches, confirm a recent
   backup (Time Machine or the owner's own) exists; if unknown, ask the owner first.
7. **No secrets.** Do not read the keychain, password stores, tokens, browser profiles or
   private files. Leave out user names, host names and serial numbers when quoting output.
8. **No OS upgrade or firmware change.** Report available updates; never start them.
9. **No scratch files by default.** The measurement blocks write nothing to disk. If a step really

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
## Boundaries

1. **Read-only measuring.** No `sudo`, no `tmutil` writes, no `defaults write`, no `launchctl`
   load/unload/bootout, no `kill`, no `mdutil -i`/`-E`, no `memory_pressure -l` (it simulates
   pressure instead of reading it).
2. **Protected places stay closed.** Do not list, size or search Desktop, Documents, Downloads,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
4. **Propose.** Build a numbered list of actions, each with benefit (expected effect, measured
   size), risk, rollback, and whether a dialog or admin password is needed
   (section "Cleanup proposals"). Biggest effect first.
5. **Approval.** Wait for the owner's explicit choice per action. No approval, no change.
6. **Act.** One action at a time, with `trash` for anything removed. Stop at the first surprise.
7. **Measure again.** Repeat the measurement that motivated the action and show before/after.
8. **Log.** Keep a short log: date, action, command, before/after, rollback. Keep open findings

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
## Done when

- Every value in the report names its command and time.
- Every proposed action has benefit, risk and rollback, and nothing ran without approval.
- Every executed action has a before/after measurement and a log entry.
- Places that were not checked (protected folders, admin-only paths) are named in the report.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
| High memory from a browser | Show per-app totals, suggest closing tabs or enabling the browser's memory saver | Killing processes |
| Swap high after long uptime | Suggest a restart at a convenient time, then measure again | Purge tools |
| Disk almost full | List the five biggest measured folders; suggest moving archives to external or network storage (copy, verify count and size, then Trash the original) | Deleting local Time Machine snapshots, moving files the owner has not named |
| Spotlight busy for hours | Show `mdutil -s /` and the busy processes; suggest waiting or excluding a build folder in System Settings → Spotlight | `mdutil -E` without approval |

### Trash discipline

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

For one launch agent or daemon, read what it starts and who signed it:

sh
plutil -p ~/Library/LaunchAgents/<label>.plist
codesign -dv --verbose=2 "<path of Program or ProgramArguments[0]>" 2>&1 | grep -E "Identifier|TeamIdentifier|Authority=Developer"

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
vendor_of() { sed -E 's/^group\.//; s/^[A-Z0-9]{10}\.//' | tr 'A-Z' 'a-z' | cut -d. -f1-2; }
vendors=$( { mdfind -onlyin /Applications "kMDItemContentType == 'com.apple.application-bundle'"
  ls -d ~/Applications/*.app 2>/dev/null; } | while read -r a; do
  /usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$a/Contents/Info.plist" 2>/dev/null
done | vendor_of | sort -u )
echo "installed vendors: $(printf '%s\n' "$vendors" | wc -l)"
for base in Preferences Caches "Application Support" "Saved Application State" LaunchAgents Logs; do

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md
done | vendor_of | sort -u )
echo "installed vendors: $(printf '%s\n' "$vendors" | wc -l)"
for base in Preferences Caches "Application Support" "Saved Application State" LaunchAgents Logs; do
  ls -1 "$HOME/Library/$base" 2>/dev/null | sed 's/\.plist$//; s/\.savedState$//' |
  grep -E '^[A-Za-z0-9-]+\.[A-Za-z0-9-]+\.' | grep -iv -e '^com\.apple\.' -e '^systemgroup\.' |
  while read -r n; do
    v=$(echo "$n" | vendor_of)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
vendor_of() { sed -E 's/^group\.//; s/^[A-Z0-9]{10}\.//' | tr 'A-Z' 'a-z' | cut -d. -f1-2; }
vendors=$( { mdfind -onlyin /Applications "kMDItemContentType == 'com.apple.application-bundle'"
  ls -d ~/Applications/*.app 2>/dev/null; } | while read -r a; do
  /usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$a/Contents/Info.plist" 2>/dev/null
done | vendor_of | sort -u )
echo "installed vendors: $(printf '%s\n' "$vendors" | wc -l)"
for base in Preferences Caches "Application Support" "Saved Application State" LaunchAgents Logs; do

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
cards, vendor names without Team ID check |
| Leftovers in `/Library` | Give the owner one exact command with exact paths for their own Terminal; they type the admin password | Running `sudo` yourself |
| Leftovers inside `~/Library/Containers` | Owner opens the folder in Finder (`open ~/Library/Containers`) and drags exact folders to the Trash | Sizing or listing inside containers from the agent's shell |
| Orphaned launch agent | Quit the program, `trash` the plist, log out and in, check `launchctl list` | `launchctl bootout`/`unload` without approval |
| System or network extension | Report it with developer and state; the owner decides, with their IT or security vendor if managed | Removing, disabling, or giving removal steps for any extension |
| High memory from a browser | Show per-app totals, suggest closing tabs or enabling the browser's memory saver | Killing processes |
| Swap high after long uptime | Suggest a restart at a convenient time, then measure again | Purge tools |

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

md
the checked candidate list | Wildcards, vendor names without Team ID check |
| Leftovers in `/Library` | Give the owner one exact command with exact paths for their own Terminal; they type the admin password | Running `sudo` yourself |
| Leftovers inside `~/Library/Containers` | Owner opens the folder in Finder (`open ~/Library/Containers`) and drags exact folders to the Trash | Sizing or listing inside containers from the agent's shell |
| Orphaned launch agent | Quit the program, `trash` the plist, log out and in, check `launchctl list` | `launchctl bootout`/`unload` without approval |
| System or network extension | Report it with developer and state; the owner decides, with their IT or security vendor if managed | Removing, disabling, or giving removal steps for any extension |
| High memory from a browser | Show per-app totals, suggest closing tabs or enabling the browser's memory saver | Killing processes |
| Swap high after long uptime | Suggest a restart at a convenient time,