MyMacOptimizer

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill coherently controls a local Mac optimizer app, but it can trigger cleanup, file deletion, and app uninstallation, so users should confirm destructive actions and trust the local app first.

Before installing, make sure you trust the local My Mac Optimizer application and only approve cleanup, delete, or uninstall actions after checking the exact items the agent proposes to change.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If the wrong path is selected or confirmed, an app or file could be removed from the Mac.

Why it was flagged

The skill documents raw localhost API calls that can uninstall applications or move files to Trash. This is aligned with a Mac optimizer/uninstaller, and the skill asks for confirmation, but these are high-impact local actions.

Skill content

curl -X POST http://127.0.0.1:8000/api/apps/delete ... -d '{"path": "/Applications/Example.app"}' ... curl -X POST http://127.0.0.1:8000/api/files/delete ... -d '{"path": "/Users/username/Downloads/large-file.zip"}'

Recommendation

Only approve delete or uninstall actions after reviewing the exact file or application path.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill itself does not install code, but users must separately trust whatever local app is listening on the documented localhost port.

Why it was flagged

The skill relies on an external local application/backend, but the registry artifacts do not identify a source or homepage for that dependency.

Skill content

Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.

Recommendation

Verify that the intended My Mac Optimizer app is running and obtained from a trusted source before using the skill.