macos-security-scan

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:39 AM UTC
• Version: 1.0.0

Overview

This skill performs a local macOS security check and saves a local report; its sensitive reads and optional sudo use are purpose-aligned and disclosed.

Install this only if you are comfortable with a local scanner inventorying sensitive Mac security details and saving them to ~/Desktop/security_report.md. Use the sudo mode only when you want deeper read access, and avoid sharing the generated report publicly because it can reveal private system and app information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes shell execution and writes a report file to the user's Desktop, but it does not declare a clear, restrictive tool scope such as allowed tools or explicit write boundaries. That makes the actual execution capability broader than the metadata communicates, increasing the risk of unintended command execution or file writes if the script or invocation is changed later.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

compatibility:
  os: macOS 12 (Monterey) or later
  tools: bash, python3 (built-in on macOS)
  permissions: Standard user account (some checks need sudo for full results)
---

# macOS Security Scan Skill

• Confidence: 50% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script claims to be read-only, but it writes a detailed security report to disk by default. That report can contain sensitive hostnames, process names, login items, network connections, privacy permissions, and installed software, creating a local confidentiality risk and violating user expectations.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The documentation says the script never modifies the system, but the code creates parent directories and writes a report file. While not destructive, this is still a filesystem modification and is especially problematic in a security-scanning tool where users may rely on strict non-modification guarantees.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

import json
import os
import platform
import plistlib
import re
import socket
import subprocess

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if use_sudo:
        cmd = ["sudo", "-n"] + cmd
    try:
        r = subprocess.run(
            cmd, capture_output=True, text=True, timeout=timeout
        )
        return r.stdout.strip(), r.stderr.strip(), r.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Session Persistence

Medium

• Category: Rogue Agent

Content

icon = "🚨" if suspicious else "  "
            lines.append(f"  {icon} `{item['label']}`{run_label}")
            lines.append(f"       Program: `{item['program']}`")
            lines.append(f"       Plist:   `{item['path']}`")
    return "\n".join(lines)

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.