ClawHub
Back to skill

Security audit

macOS

Security checks for vulnerabilities and agentic risk

Overview

This is a macOS administration reference skill with sensitive command examples, but it does not install code, run commands automatically, or hide unrelated behavior.

Install only if you want macOS command-line administration guidance. Review commands before running them, especially sudo, launchctl, defaults write/delete, clipboard, screenshot, Keychain, TCC, and SIP commands, because they can change system settings, expose local data, or require elevated permissions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
- List interfaces: `networksetup -listallhardwareports`
- Get IP: `ipconfig getifaddr en0` (Wi-Fi usually en0 on laptops)
- DNS servers: `scutil --dns | grep nameserver`
- Flush DNS: `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`
- Proxy settings: `networksetup -getwebproxy "Wi-Fi"`

## System Integrity Protection

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
- User agents: `~/Library/LaunchAgents/` — runs as user when logged in
- System daemons: `/Library/LaunchDaemons/` — runs at boot as root
- Load: `launchctl load -w ~/Library/LaunchAgents/com.example.plist`
- Unload before editing: `launchctl unload` — edits to loaded plists are ignored
- Check errors: `launchctl list | grep service_name` then `launchctl error <exit_code>`
- Logs: `log show --predicate 'subsystem == "com.example"' --last 1h`

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
- User agents: `~/Library/LaunchAgents/` — runs as user when logged in
- System daemons: `/Library/LaunchDaemons/` — runs at boot as root
- Load: `launchctl load -w ~/Library/LaunchAgents/com.example.plist`
- Unload before editing: `launchctl unload` — edits to loaded plists are ignored
- Check errors: `launchctl list | grep service_name` then `launchctl error <exit_code>`
- Logs: `log show --predicate 'subsystem == "com.example"' --last 1h`

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
- User agents: `~/Library/LaunchAgents/` — runs as user when logged in
- System daemons: `/Library/LaunchDaemons/` — runs at boot as root
- Load: `launchctl load -w ~/Library/LaunchAgents/com.example.plist`
- Unload before editing: `launchctl unload` — edits to loaded plists are ignored
- Check errors: `launchctl list | grep service_name` then `launchctl error <exit_code>`
- Logs: `log show --predicate 'subsystem == "com.example"' --last 1h`

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
## defaults (Preferences)

- Read: `defaults read com.apple.finder AppleShowAllFiles`
- Write: `defaults write com.apple.finder AppleShowAllFiles -bool true`
- Delete: `defaults delete com.apple.finder AppleShowAllFiles`
- Restart app after changing: `killall Finder`
- Find app bundle ID: `osascript -e 'id of app "App Name"'`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
- Prevent sleep: `caffeinate -i command` — keeps system awake while command runs
- Prevent sleep with timeout: `caffeinate -t 3600` — 1 hour
- Check why not sleeping: `pmset -g assertions`
- Power settings: `pmset -g` to view, `sudo pmset -a sleep 0` to disable sleep
- Current app in focus: `osascript -e 'tell application "System Events" to get name of first process whose frontmost is true'`

## Network

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md
- Prevent sleep: `caffeinate -i command` — keeps system awake while command runs
- Prevent sleep with timeout: `caffeinate -t 3600` — 1 hour
- Check why not sleeping: `pmset -g assertions`
- Power settings: `pmset -g` to view, `sudo pmset -a sleep 0` to disable sleep
- Current app in focus: `osascript -e 'tell application "System Events" to get name of first process whose frontmost is true'`

## Network

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file includes defaults write, defaults delete, and killall Finder, which can alter user preferences and restart an application. The section presents these commands as usage tips but does not explicitly warn that they modify persistent settings and may disrupt the current desktop session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The clipboard section shows how to copy data into the clipboard and retrieve it with pbpaste, which can expose sensitive user data or replace existing clipboard contents. The markdown does not warn users about the privacy impact or the fact that existing clipboard contents may be overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file provides screenshot and clipboard-capture commands, including saving captures to files and copying them to the clipboard. Although permission requirements are mentioned, there is no explicit warning that these actions can capture sensitive on-screen data or leave artifacts in files/clipboard history.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.