coordinate-external-ag…
Coordinate independently operated external agents through durable handoffs. Use when work crosses hosts, sessions, accounts,…
@gaelic-ghostInstall SkillDevelopment
Skill
/inspect-macos-persistence
Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.
Claude Code
$ npx -y skills add gaelic-ghost/socket --skill inspect-macos-persistence --agent claude-code
Codex
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a codex -y
Cursor
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a cursor -y
Gemini CLI
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a gemini-cli -y
GitHub Copilot
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a github-copilot -y
OpenCode
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a opencode -y
Windsurf
$ npx skills add gaelic-ghost/socket --skill inspect-macos-persistence -a windsurf -y
SKILL.md
inspect-macos-persistence.SKILL.mdname: inspect-macos-persistence
description: Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.
Inspect macOS Persistence
Overview
Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.
Read [references/macos-persistence-surfaces.md](references/macos-persistence-surfaces.md) for prioritized surfaces and evidence fields.
Workflow
1. Record host/build, user domains, event timeline, and the suspected executable or label.
- Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.
2. Inventory user-visible registrations.
- Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.
3. Inventory launch services.
- Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through `launchctl` read operations.
- Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.
4. Inspect adjacent persistence.
- Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.
5. Correlate provenance and runtime.
- Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.
6. Classify each item.
- Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.
- Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.
7. Preserve before containment.
- Record files and service state before using official `launchctl bootout` or app/uninstaller paths in the containment workflow.
Output
Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.
Read more
name: inspect-macos-persistence description: Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.
Inspect macOS Persistence
Overview
Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.
Read [references/macos-persistence-surfaces.md](references/macos-persistence-surfaces.md) for prioritized surfaces and evidence fields.
Workflow
1. Record host/build, user domains, event timeline, and the suspected executable or label.
- Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.
2. Inventory user-visible registrations.
- Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.
3. Inventory launch services.
- Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through `launchctl` read operations.
- Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.
4. Inspect adjacent persistence.
- Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.
5. Correlate provenance and runtime.
- Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.
6. Classify each item.
- Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.
- Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.
7. Preserve before containment.
- Record files and service state before using official `launchctl bootout` or app/uninstaller paths in the containment workflow.
Output
Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.
10200 skills5 MCP
Stars on GitHub
Momentum
- stars in total
- 10
Other skills on socket.
@gaelic-ghostInstall Skillcoordinate-worktrees-a…
Assign worktree, branch, write, validation, integration, and cleanup ownership before parallel repository work. Use when a worker…
@gaelic-ghostInstall Skilldesign-agent-automatio…
Design framework-neutral agent and automation workflows before implementation. Use when choosing between Codex app automations,…
@gaelic-ghostInstall Skilldesign-agent-eval-work…
Design evaluation workflows for agent, skill, prompt, and automation behavior before implementation. Use when choosing eval…
@gaelic-ghostInstall Skilldesign-n8n-agent-workf…
Design safe n8n workflows with deterministic routing, credentials, idempotency, recovery, local-model checks, drafts, and exact…
@gaelic-ghostInstall Skillorchestrate-agent-work
Coordinate bounded worker tasks with a launch envelope, report-back, escalation, and synthesis contract. Use before spawning,…
@gaelic-ghostInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about inspect-macos-persistence.
- Which coding agents can use inspect-macos-persistence?
- inspect-macos-persistence installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.