The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill provides a comprehensive guide for bypassing macOS security frameworks. It includes commands to modify the TCC database to grant unauthorized permissions, instructions for disabling System Integrity Protection (SIP) via csrutil disable, and techniques for exploiting entitlements such as com.apple.security.cs.disable-library-validation. It also lists numerous CVEs for version-specific bypasses.\n- [PERSISTENCE]: The skill details multiple methods to ensure code execution persists across reboots. This includes instructions for creating malicious LaunchAgents, LaunchDaemons, and Login Items, as well as abusing cron jobs and Folder Action scripts.\n- [COMMAND_EXECUTION]: The playbook contains actionable command-line examples for subverting OS protections, such as using xattr -d com.apple.quarantine to remove Gatekeeper protections from untrusted binaries and script-based automation to access protected file locations.\n- [DATA_EXFILTRATION]: The skill identifies sensitive user data as targets by providing specific file paths for Messages history (~/Library/Messages/chat.db) and Mail databases, noting their accessibility once security controls are bypassed.

macos-security-bypass