macos-complete-uninstall
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several macOS-specific utilities to inventory and remove software components. These include launchctl for service management, tccutil for privacy permission resets, security for identifying keychain entries, and sfltool for background item registry checks. These commands are necessary for the skill's stated administrative purpose.\n- [DYNAMIC_EXECUTION]: The scripts/inventory.sh file executes inline Python code via python3
- to perform complex data processing, such as walking process trees to exclude the agent's own ancestry and parsing browser preference JSON files. This dynamic execution is local and used for utility logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill's inventory process involves reading the contents of various user-controlled files, creating a potential surface for indirect injection if these files contain malicious instructions.\n
- Ingestion points: scripts/inventory.sh reads and outputs contents from shell configuration files (e.g., .zshrc, .bash_profile), browser Secure Preferences files, and Native Messaging manifests.\n
- Boundary markers: The skill relies on the agent's task context (building an inventory table) rather than explicit safety delimiters for the file content.\n
- Capability inventory: The agent is given capabilities to delete files (rm -rf), unload services (launchctl), and remove credentials (security delete-generic-password).\n
- Sanitization: External file content is printed to standard output for the agent to read without specific filtering or sanitization.
Audit Metadata