malware-scan

Heuristic sweep for suspicious behaviour on a macOS machine. Not a signature-based antivirus. Reports anomalies that are commonly — but not always — associated with malware or adware.

When to invoke

Trigger on phrases like: "scan for malware", "is there malware on my mac", "check for viruses", "suspicious processes".

Critical framing

Be explicit in the summary and in the mini-report that this is a heuristic sweep — not a signed antivirus product. False positives are expected. Legitimate tools (Homebrew services, VPN clients, dev tools) often create launch agents and unsigned helper binaries.

What to check

1. Processes in ephemeral / unusual paths — ps -axo pid,user,command | awk '$3 ~ /^\/(tmp|var\/tmp|private\/tmp|var\/folders)\// {print}'. Each match is a finding with severity warn.

2. Hidden directories in $HOME that look anomalous — ls -A "$HOME" | grep -E "^\." | grep -Ev "^(\.bash|\.z|\.git|\.npm|\.cache|\.cargo|\.rustup|\.config|\.local|\.ssh|\.gnupg|\.docker|\.colima|\.claude|\.cursor|\.vscode|\.idea|\.oh-my-zsh|\.CFUserTextEncoding|\.Trash|\.DS_Store|\.viminfo|\.lesshst|\.wget-hsts|\.python_history|\.node_repl_history|\.bashrc|\.profile|\.zsh|\.nvm|\.pyenv|\.rvm|\.vim|\.tool-versions|\.yarn|\.gem|\.m2|\.gradle|\.android|\.expo|\.terraform\.d|\.aws|\.kube|\.helm|\.ansible|\.serverless|\.netrc|\.curlrc|\.subversion|\.hg|\.openjdk)$". Unmatched entries: info. Record up to 20.

3. Unsigned binaries referenced by user LaunchAgents — for each .plist in ~/Library/LaunchAgents, extract the Program or first ProgramArguments entry, then run codesign --verify --verbose=0 <path>. Non-zero exit = finding warn with the program path and launch agent path.