A read-only security auditing tool that identifies keyloggers, suspicious processes, and system tampering on macOS devices.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install macos-security-scan
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install macos-security-scan using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is macOS Security Scan?
The macOS Security Scan is a specialized diagnostic tool designed for users who need to verify the integrity of their Apple computers. Whether a device has recently been serviced by a third-party repair shop or is showing signs of suspicious activity, this skill within the Openclaw Skills library provides a comprehensive technical audit without modifying any system files. It focuses on identifying indicators of compromise that traditional antivirus might miss, such as unauthorized kernel extensions or hidden persistence mechanisms.
By running this skill, users gain a transparent view of their system's security posture. It examines everything from browser extensions to system-level integrity settings, delivering a detailed report that categorizes findings by risk level. This makes it an essential utility for security-conscious developers and power users who want to ensure their environment remains untampered and secure.
macOS Security Scan Use Cases
- Auditing a Mac for unauthorized software after it has been handled by third-party repair services.
- Detecting active keyloggers or processes with suspicious input monitoring permissions.
- Identifying unknown startup items, launch agents, or daemons that may have been installed maliciously.
- Investigating unexpected network connections or outbound traffic to non-standard IP addresses.
- Verifying that critical macOS security features like System Integrity Protection (SIP) and FileVault are correctly enabled.
How macOS Security Scan Works
- The user initiates the scan through an agent powered by Openclaw Skills, choosing between standard or sudo-elevated permissions.
- A Python-based scanning engine executes a series of read-only checks across the filesystem and system memory.
- The skill aggregates data regarding running processes, network state, and security configuration settings.
- A detailed Markdown report is generated and saved to the user's desktop for review.
- The agent interprets the technical results and provides a plain-English summary, highlighting any items that require immediate attention.
macOS Security Scan Setup
This skill requires macOS 12 (Monterey) or later and utilizes the built-in Python 3 interpreter. To execute the scan within the Openclaw Skills environment, the agent runs the following command:
# Standard scan (Read-only)
python3 scripts/scan.py --out ~/Desktop/security_report.md
# Deep scan (Requires sudo for restricted directory access)
python3 scripts/scan.py --sudo --out ~/Desktop/security_report.md
macOS Security Scan Data Schema & Taxonomy
The skill generates a structured report that categorizes system state into logical sections. The following data points are captured and analyzed:
| Category | Description of Data Collected |
|---|---|
| Persistence | Checks all LaunchAgents, LaunchDaemons, and Login Items for unknown entries. |
| Processes | Scans for active processes in temp directories or those lacking valid bundle IDs. |
| Network | Maps active listening ports and outbound connections to non-Apple IP ranges. |
| Hardware/Kernel | Identifies third-party kernel extensions and IOHIDFamily hooks (potential keyloggers). |
| Privacy | Lists applications with Screen Recording, Accessibility, or Full Disk Access permissions. |
| Security Config | Reports on the status of SIP, Gatekeeper, and FileVault. |
macOS Security Scan Advanced Features
- Sudo-level integration for auditing protected system directories and restricted kernel metadata.
- Automated cross-referencing of active process names against a database of known malware signatures.
- Comprehensive browser extension auditing for Safari, Chrome, and Firefox to detect session hijackers.
- Intelligent flagging of software installations and system changes occurring within a 14-day window.
- Heuristic detection of suspicious process behaviors, such as binaries executing from hidden or temporary folders.
SKILL.md
Loading
Related Openclaw Skills
Antibody Humanizer
A professional bioinformatics tool for converting murine antibody sequences into humanized therapeutic candidates while preserving binding affinity.
AI Intelligent API Management
A comprehensive AI-driven toolset for visual API design, automated documentation generation, and integrated interface testing.
Gitignore Reference Tool
A local, high-speed reference tool for mastering .gitignore patterns, security best practices, and debugging within your development environment.
Beat
A local-first command-line tool for tracking, analyzing, and managing music and audio files with full data privacy.
Feishu Bitable CRUD Skill
A specialized skill for OpenClaw agents to perform seamless create, read, update, and delete operations on Feishu/Lark Bitable spreadsheets.
After Effects MCP Bridge
An advanced automation bridge for Adobe After Effects that leverages ExtendScript and aerender for programmatic motion graphics workflows.
Featured*
