Versioned security assessment

Report ID: SA-2BAC8461

7/4/2026, 5:40:11 PM

mac-automation security assessment v5

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
mac-automation
Version
v5
Maintainer
7Sageer, Claude
Source
github.com/7Sageer/cc-assistant/tree/main/.claude/skills/mac-automation
Coverage
9 Files scanned · 2,301 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

I confirmed the core external-command risk because the skill directs agents to execute AppleScript with osascript and includes shell execution examples. The Safari URL, keylogger, screenshot-upload, and Python HTTP alerts are false positives for malicious networking, keylogging, uploads, or HTTP use, but local screenshot and keystroke automation remain privacy-sensitive. No evidence found of prompt injection text in the reviewed skill files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

9 Files scanned · 2,301 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 32 evidence locations

Capability review items (8)
Medium
SKILL.md:10
Ruby/shell backtick execution
This skill enables control of macOS applications and system functions through AppleScript execution
The skill explicitly states that it controls macOS through AppleScript execution via the osascript command. That is legitimate for this skill, but it is real local command execution under the user's permissions.
Medium
SKILL.md:14
Ruby/shell backtick execution
Execute AppleScript commands using the Bash tool with `osascript`:
The cited line instructs agents to use the Bash tool with osascript. This is the intended mechanism, but it creates a confirmed external-command risk.
Medium
SKILL.md:16-18
Ruby/shell backtick execution
```bash
The cited code block includes an osascript command that executes AppleScript from the shell. That command can affect local apps and data, so the external-command finding is confirmed.
Medium
SKILL.md:21-27
Ruby/shell backtick execution
```bash
The cited multi-line shell block invokes osascript through a heredoc. This is functional command execution, even though it is presented as documentation.
Medium
SKILL.md:105-107
Ruby/shell backtick execution
```bash
The cited quick reference executes osascript to display a notification. It is a benign example, but it still confirms local external command execution.
Medium
SKILL.md:110-112
Ruby/shell backtick execution
```bash
The cited block activates an application through osascript. Launching or focusing local apps is a real automation side effect, so the external-command risk is confirmed.
Medium
SKILL.md:115-122
Ruby/shell backtick execution
```bash
The cited volume-control examples run osascript commands from Bash. They change local system state and confirm the external-command capability.
Medium
SKILL.md:125-130
Ruby/shell backtick execution
```bash
The cited clipboard examples run osascript from the shell to read and set clipboard content. Clipboard access is privacy-sensitive, so the external-command finding is confirmed.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
references/system-applescript.md:229-236references/system-applescript.md:283-296
Local Screen Capture and Keystroke Automation
The system reference includes examples that capture the screen and send keystrokes to the active session. These actions can reveal private content or manipulate apps without careful user confirmation.
The cited examples directly show screencapture commands and System Events keystroke commands. They are not upload or keylogging code, but they are sensitive local automation capabilities.
RISK-002 Medium
SKILL.md:31-46SKILL.md:60-72
Broad Privacy-Sensitive macOS Access
The skill advertises reading Mail, Calendar, Finder, clipboard, and system data through AppleScript. These functions can expose private local content if prompts are overbroad or malicious.
The cited sections explicitly list Mail, Calendar, Finder, and system-control capabilities. The risk is contextual rather than hidden because the skill also states privacy guidance.
RISK-003 Medium
SKILL.md:197-236SKILL.md:246-250
Self-Modifying Skill Documentation Workflow
The self-improvement protocol tells the assistant to edit reference files and update the skill version after failures. This can mutate installed skill content during normal use and reduce auditability.
The cited protocol directly instructs use of the Edit tool on skill reference files and version metadata. It appears intended for maintenance, but it still changes reviewed content after installation.
RISK-004 Medium
references/system-applescript.md:268-280
Disruptive System Power Actions
The system reference includes restart, shutdown, sleep, and logout examples. These operations can interrupt user work if executed without clear confirmation.
The cited lines contain explicit AppleScript examples for restart, shutdown, sleep, and logout. macOS may prompt for some actions, but the examples remain disruptive automation patterns.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Screenshot and keystroke examples are privacy-sensitive even though they are not upload or keylogging code.
    Label screen capture and keyboard simulation examples as high-risk and require visible user approval before execution.
  2. FIX-002
    Medium
    External command execution through osascript is central to the skill.
    Require explicit user confirmation before running generated AppleScript, especially when the script uses do shell script or changes system state.
  3. FIX-003
    Medium
    The skill can access private Mail, Calendar, Finder, clipboard, and browser data.
    Add a consent checklist for each sensitive app and limit displayed results to the minimum data requested by the user.
  4. FIX-004
    Medium
    The self-improvement protocol asks the assistant to edit installed skill documentation.
    Move documentation updates to a maintainer workflow and avoid modifying skill files during ordinary automation use.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (7)
Critical
references/system-applescript.md:260
Keylogger keywords
osascript -e 'tell application "System Events" to keystroke "q" using {control down, command down}'
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
references/system-applescript.md:285
Keylogger keywords
### Keystroke
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
references/system-applescript.md:287
Keylogger keywords
osascript -e 'tell application "System Events" to keystroke "hello"'
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
references/system-applescript.md:293
Keylogger keywords
osascript -e 'tell application "System Events" to keystroke "s" using command down'
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
references/system-applescript.md:296
Keylogger keywords
osascript -e 'tell application "System Events" to keystroke "n" using {command down, shift down}'
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
references/system-applescript.md:231
Screen capture upload
osascript -e 'do shell script "screencapture ~/Desktop/screenshot.png"'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/system-applescript.md:236
Screen capture upload
osascript -e 'do shell script "screencapture -i ~/Desktop/screenshot.png"'
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable