Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Mac health monitor, but it can invoke sudo automatically for temperature collection without a clearly separated opt-in path.
Review this skill before installing. It appears intended for local Mac diagnostics and does not show exfiltration, destructive behavior, remote payloads, or persistence, but users should be comfortable with a monitoring script that runs shell commands and may attempt sudo for temperature data. Prefer using non-temperature status/check modes unless elevated temperature collection is explicitly desired.
The skill invokes shell commands (python3 scripts/macvital.py ...) but does not declare any permissions or allowed-tools scope. That creates an authorization gap where an agent or platform may execute shell-capable behavior without an explicit, reviewable tool boundary, increasing the risk of unintended command execution or overbroad access.
The documentation explicitly instructs use of sudo to run the temperature command, which elevates execution to root. Even if intended for legitimate hardware monitoring, encouraging privileged execution increases the blast radius if the script is modified, its path is hijacked, or an agent runs it in an unsafe context.
# Temperature only (more accurate with sudo)
python3 scripts/macvital.py temp
sudo python3 scripts/macvital.py temp
# Exit code check (for scripting: 0=ok, 1=warn, 2=critical)
python3 scripts/macvital.py check
The helper executes string commands with shell=True, which is dangerous because any future caller that passes untrusted input will gain shell injection capabilities. In this file, get_disk(path='/') already interpolates a parameter into a shell command, so the pattern is not merely theoretical and creates a real command-injection sink if path becomes user- or agent-controlled.
def run(cmd, timeout=10):
try:
r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=isinstance(cmd, str))
return r.stdout.strip()
except Exception:
return ''
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
def get_temps():
"""Get thermal info. Die temps need sudo; pressure state is always available."""
temps = {}
# Thermal pressure state (no sudo needed) via notarization
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
"""Get thermal info. Die temps need sudo; pressure state is always available."""
temps = {}
# Thermal pressure state (no sudo needed) via notarization
try:
# macOS thermal pressure: 0=nominal, 1=fair, 2=serious, 3=critical
ioreg_out = run(
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
"""Get thermal info. Die temps need sudo; pressure state is always available."""
temps = {}
# Thermal pressure state (no sudo needed) via notarization
try:
# macOS thermal pressure: 0=nominal, 1=fair, 2=serious, 3=critical
ioreg_out = run(
This line executes sudo powermetrics directly from the skill, causing an implicit privileged action during routine telemetry collection. Even if command injection is not present in this exact call, automatically invoking sudo is risky in agent workflows because it can expand privileges unexpectedly and alter trust assumptions for a simple monitoring tool.
pass
# Try powermetrics for actual die temps (requires sudo)
pm_out = run('sudo powermetrics -n 1 -i 500 --samplers cpu_power 2>/dev/null', timeout=8)
if pm_out:
cpu_match = re.search(r'CPU die temperature:\s+([\d.]+)', pm_out)
gpu_match = re.search(r'GPU die temperature:\s+([\d.]+)', pm_out)
The skill automatically attempts to invoke sudo powermetrics during a general health check, which expands its privilege boundary beyond the stated quick diagnostic purpose. In an agent setting, unexpected privileged execution can trigger password prompts, fail unpredictably, or normalize running monitoring tools with elevated rights, increasing operational and security risk.
The code comment suggests sudo is merely an external requirement, but the implementation proactively runs a sudo command itself. This mismatch is dangerous because it can mislead reviewers and downstream agents about the actual privilege behavior of the skill, reducing transparency around elevated operations.
No suspicious patterns detected.