Security audit

macos-memory-triage

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed macOS troubleshooting skill that can stop processes, disable plugins, unload launch agents, and clear named caches, but it repeatedly requires user review and keeps actions scoped and reversible.

Install only if you are comfortable with a troubleshooting workflow that inspects local process and tool configuration state and may, with your approval, stop processes, disable plugin flags, unload launch agents, or clear npm/npx cache files. Review each target carefully before approving any kill, config edit, launchctl command, or rm command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Agent Config Directory Access

High

Category: Agent Snooping
Content: ps aux | grep -iE "npx|npm exec|mcp" | grep -v grep ``` If the tool in question stores its enabled-plugin list in a config file (for Claude Code, that's `enabledPlugins` in `~/.claude/settings.json`), read it and cross-reference: plugins the user doesn't actually use are pure overhead — each one is a standing process even when idle. Also check how many separate sessions/windows of the tool are running, and for how long:
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash npm cache clean --force rm -rf ~/.npm/_npx/* ``` This is disk cleanup, not RAM relief — mention that distinction to the user so they don't expect swap to drop from this step alone.
Confidence: 90% confidence
Finding: This finding is a true issue because the skill author explicitly allows `rm -rf` for a named cache path, creating a dangerous precedent for recursive deletion in an agent-operated workflow. Even with benign intent, destructive filesystem commands are high-risk in troubleshooting skills because small path-expansion errors can cause disproportionate data loss.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ```bash npm cache clean --force rm -rf ~/.npm/_npx/* ``` This is disk cleanup, not RAM relief — mention that distinction to the user so they don't expect swap to drop from this step alone.
Confidence: 90% confidence
Finding: This finding is a true issue because the skill author explicitly allows `rm -rf` for a named cache path, creating a dangerous precedent for recursive deletion in an agent-operated workflow. Even with benign intent, destructive filesystem commands are high-risk in troubleshooting skills because small path-expansion errors can cause disproportionate data loss.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: This skill inspects live system state and then stops or disables things. That second part is real — it changes what's running on the machine. Because of that: - **Run this only in a mode where every command is shown and manually approved before it executes** (e.g. Claude Code's default "ask before running" mode, or an explicit "accept edits" review step). Do not run this skill's remediation commands in a fully autonomous/auto-approve mode. PIDs and process names are only meaningful in the moment they were captured — a stale PID reused by an unrelated process is a real (if rare) risk, and a human glance at the `ps` line before a `kill` is cheap insurance against it. - **Never kill a PID you haven't shown the user first.** Always print the full `ps` line for a process (command, args, start time) immediately before killing it, so the person approving the command knows what they're actually stopping. - **Hard boundary — nothing in this skill is allowed to be irreversible.** Stopping a process, flipping a config flag off, or deleting a *regenerable cache* (like `npm`'s download cache) all count as safe: the thing comes back on its own or with a simple restart/reinstall. Deleting an application, uninstalling a package, removing user files, or any `rm -rf` outside the specific cache paths named below does **not** count as safe and is out of scope for this skill — do not do it, and do not suggest it as an escalation. - **If a plain `kill` (or `kill -9`) doesn't make something go away for good, that is a signal to investigate, not a license to escalate.** See "When a killed process comes back" below. The answer is never "delete the app that owns it."
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash launchctl list | grep -i "<name>" ``` If it shows up, it likely has a launch agent plist under `~/Library/LaunchAgents/`. Unloading it stops the process *and* the auto-restart behavior, and it's fully reversible: ```bash launchctl unload ~/Library/LaunchAgents/<the-plist-file>.plist # to bring it back later:
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash launchctl list | grep -i "<name>" ``` If it shows up, it likely has a launch agent plist under `~/Library/LaunchAgents/`. Unloading it stops the process *and* the auto-restart behavior, and it's fully reversible: ```bash launchctl unload ~/Library/LaunchAgents/<the-plist-file>.plist # to bring it back later:
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash launchctl list | grep -i "<name>" ``` If it shows up, it likely has a launch agent plist under `~/Library/LaunchAgents/`. Unloading it stops the process *and* the auto-restart behavior, and it's fully reversible: ```bash launchctl unload ~/Library/LaunchAgents/<the-plist-file>.plist # to bring it back later:
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash launchctl unload ~/Library/LaunchAgents/<the-plist-file>.plist # to bring it back later: launchctl load ~/Library/LaunchAgents/<the-plist-file>.plist ``` **Check if it's a child of a running app:**
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```bash launchctl unload ~/Library/LaunchAgents/<the-plist-file>.plist # to bring it back later: launchctl load ~/Library/LaunchAgents/<the-plist-file>.plist ``` **Check if it's a child of a running app:**
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.