macos-post-exploitation

macOS endpoint post-exploitation — launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery on Apple hosts.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable macOS post-exploitation playbook with excellent command-level guidance and token efficiency, weakened only by the absence of explicit validation checkpoints in destructive workflows.

Suggestions

Add explicit verify/validate checkpoints for destructive or noisy steps (e.g. confirm SIP state before TCC.db writes; verify a plist loads with 'launchctl print' after bootstrap).

Convert the bare 'See also' paths into markdown links and signal whether they are one-level-deep references or sibling skills.

Dimension	Reasoning	Score
Conciseness	Lean and command-dense throughout; assumes Claude's knowledge of TCC/SIP/AMFI and never pads with concept explanations — every line earns its place.	5 / 5
Actionability	Copy-paste-ready commands cover the common cases — 'sqlite3 ~/Library/Application Support/com.apple.TCC/TCC.db …', 'launchctl bootstrap gui/$(id -u) <plist>', 'security dump-keychain -d', 'xattr -d com.apple.quarantine' — with concrete flags and paths.	5 / 5
Workflow Clarity	Content is organized by kill-chain phase (Discovery → Privesc → Persistence → Evasion → Credential → C2), but destructive/batch operations lack explicit validation checkpoints, capping workflow clarity at 3 per the rubric.	3 / 5
Progressive Disclosure	A single well-sectioned file with clear headers and no nested references; the 'See also' sibling-skill paths are bare rather than linked, a minor organization gap keeping it just below 5.	4 / 5
	Total	17 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, distinctive description that names concrete techniques and natural trigger terms, but it lacks an explicit 'Use when…' clause so the trigger guidance is only weakly implied.

Suggestions

Append an explicit trigger clause, e.g. 'Use when performing post-exploitation on macOS/OSX/Apple hosts — persistence, TCC/keychain access, or Gatekeeper evasion.'

Add a few more user-natural synonyms (e.g. 'osx', 'osascript', 'persistence') to broaden trigger matching.

Dimension	Reasoning	Score
Specificity	Lists six concrete actions — 'launchd persistence, TCC bypass, Keychain credential access, dylib hijacking, Gatekeeper/quarantine evasion, and discovery' — giving comprehensive coverage of the domain's specific techniques.	5 / 5
Completeness	The 'what' is explicit and concrete, but there is no 'Use when…' clause or equivalent explicit trigger guidance, capping completeness at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural terms a macOS security user would say — 'macOS', 'Apple hosts', 'launchd', 'TCC', 'Keychain', 'dylib', 'Gatekeeper', 'quarantine' — with synonyms (macOS/Apple) covered.	5 / 5
Distinctiveness Conflict Risk	A clearly defined macOS post-exploitation niche with distinct trigger vocabulary and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/post-exploit/macos/SKILL.md
Commit: 31e1c8e

Reviewed: 15 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.