Macos Connectivity Restore

SuspiciousAudited by ClawScan on May 10, 2026.

Overview

The skill is coherent with its stated purpose, but it uses administrator-level changes and persistent startup jobs to override managed macOS AirDrop and Universal Control settings.

Install or run this only if you are authorized to change managed Mac settings. Prefer the one-time restore first, and use the persistent startup option only if you understand that it creates launchd jobs that keep reapplying the changes. Review the scripts and know how to remove the LaunchDaemon and LaunchAgent if needed.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running this can override managed Mac restrictions and may conflict with device-owner, employer, school, or MDM policy.

Why it was flagged

The root script directly edits protected managed preference files to enable AirDrop and Universal Control.

Skill content
GLOBAL_ACCESS="/Library/Managed Preferences/com.apple.applicationaccess.plist" ... set_bool_key "${GLOBAL_ACCESS}" "allowAirDrop" true
Recommendation

Run only on a Mac you own or administer, and only if you are authorized to change managed AirDrop and Universal Control policy.

ConcernHigh Confidence
ASI10: Rogue Agents
What this means

The Mac may keep re-enabling these settings even after reboot or after another administrator tries to change them back.

Why it was flagged

The installer creates launchd jobs that run automatically after reboot/login and reapply the preference changes.

Skill content
<key>RunAtLoad</key>\n  <true/> ... launchctl bootstrap system "${ROOT_PLIST}"
Recommendation

Use the persistence option only with explicit approval, and provide or verify a clear removal process for the LaunchDaemon and LaunchAgent.

ConcernHigh Confidence
ASI05: Unexpected Code Execution
What this means

A privileged installation flow that runs code from /tmp is more exposed to local tampering or race conditions than a safer, private temporary location.

Why it was flagged

The script writes an installer into a predictable /tmp path and then executes it with administrator privileges.

Skill content
ROOT_INSTALL_SH="/tmp/${ROOT_LABEL}.install.sh" ... osascript -e "do shell script \"/bin/zsh '${ROOT_INSTALL_SH}'\" with administrator privileges"
Recommendation

Review the script before approving the admin prompt; prefer a secure temporary directory or direct, integrity-controlled privileged install command.

What this means

Users may not realize from metadata alone that the skill is platform-specific and performs privileged local system changes.

Why it was flagged

The registry metadata under-declares that this is a macOS-only skill that uses system tools and privileged launchd installation.

Skill content
OS restriction: none; Required binaries: none; No install spec
Recommendation

Declare macOS-only operation and the required system tools/privileged behavior in metadata or installation notes.