Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a local macOS security check and saves a local report; its sensitive reads and optional sudo use are purpose-aligned and disclosed.
Install this only if you are comfortable with a local scanner inventorying sensitive Mac security details and saving them to ~/Desktop/security_report.md. Use the sudo mode only when you want deeper read access, and avoid sharing the generated report publicly because it can reveal private system and app information.
The skill invokes shell execution and writes a report file to the user's Desktop, but it does not declare a clear, restrictive tool scope such as allowed tools or explicit write boundaries. That makes the actual execution capability broader than the metadata communicates, increasing the risk of unintended command execution or file writes if the script or invocation is changed later.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
compatibility:
os: macOS 12 (Monterey) or later
tools: bash, python3 (built-in on macOS)
permissions: Standard user account (some checks need sudo for full results)
---
# macOS Security Scan Skill
The script claims to be read-only, but it writes a detailed security report to disk by default. That report can contain sensitive hostnames, process names, login items, network connections, privacy permissions, and installed software, creating a local confidentiality risk and violating user expectations.
The documentation says the script never modifies the system, but the code creates parent directories and writes a report file. While not destructive, this is still a filesystem modification and is especially problematic in a security-scanning tool where users may rely on strict non-modification guarantees.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
import json
import os
import platform
import plistlib
import re
import socket
import subprocess
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if use_sudo:
cmd = ["sudo", "-n"] + cmd
try:
r = subprocess.run(
cmd, capture_output=True, text=True, timeout=timeout
)
return r.stdout.strip(), r.stderr.strip(), r.returncode
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
icon = "🚨" if suspicious else " "
lines.append(f" {icon} `{item['label']}`{run_label}")
lines.append(f" Program: `{item['program']}`")
lines.append(f" Plist: `{item['path']}`")
return "\n".join(lines)
No suspicious patterns detected.