Security audit
Security checks across malware telemetry and agentic risk
This appears to be a legitimate Mac automation tool, but it gives an AI broad control over local apps without strong built-in confirmation safeguards.
Install only if you intentionally want an AI agent to control macOS applications. Pin and verify the `clam-mac` package, grant Automation and Accessibility permissions narrowly, use an app/action allowlist where possible, require human confirmation before file, email, browser, messaging, or system-setting changes, and remove generated wrappers plus revoke macOS permissions when finished.
end if
end tell
'''
result = subprocess.run(
["osascript", "-e", script],
capture_output=True, text=True, timeout=15,
)Returns:
安装和验证均成功则返回 True。
"""
result = subprocess.run(
[sys.executable, "-m", "pip", "install", "-e", str(wrapper_dir)],
capture_output=True,
text=True,# 验证入口点可用
ep_path = _entry_point_path(app_id)
result = subprocess.run(
[ep_path, "--help"],
capture_output=True,
text=True,def uninstall_wrapper(app_id: str) -> bool:
"""卸载 wrapper：pip uninstall + 删除文件 + 注销注册表。"""
# pip uninstall
subprocess.run(
[sys.executable, "-m", "pip", "uninstall", "-y", f"clam-{app_id}"],
capture_output=True,
text=True,cmd.extend([f"--{key}", str(value)])
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=35,
)
except FileNotFoundError:def _run_osascript(script: str, timeout: int = 10) -> str | None:
"""Run an AppleScript and return stdout, or None on failure."""
try:
result = subprocess.run(
["osascript", "-e", script],
capture_output=True, text=True, timeout=timeout,
)66/66 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification