ourdigital/our-claude-skills
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
6a10ce13331b1e7e042962122889a88c8df2672c
our-claude-skills/custom-skills/92-mac-optimizer/skills/mac-optimizer/references/security-checks.md
Andrew Yim 8d5cfb69fd refactor: convert mac-optimizer from raw skill to proper plugin 
Restructured 92-mac-optimizer from a CLAUDE.md-based skill into a full
Claude Code plugin with .claude-plugin/plugin.json, 6 slash commands
(/mac-doctor, /mac-packages, /mac-environment, /mac-security,
/mac-cleanup, /mac-resources), and auto-trigger SKILL.md.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 22:46:12 +09:00

2.0 KiB
Raw Blame History

Security Checks Reference

SIP (System Integrity Protection)

  • Check: csrutil status
  • Expected: "System Integrity Protection status: enabled."
  • Remediation: Reboot to Recovery Mode (Cmd+R), open Terminal, run csrutil enable
  • Severity: Critical if disabled

Gatekeeper

  • Check: spctl --status
  • Expected: "assessments enabled"
  • Remediation: sudo spctl --master-enable
  • Severity: Critical if disabled

Firewall

  • Check: /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
  • Fallback: defaults read /Library/Preferences/com.apple.alf globalstate (0=off, 1=on, 2=essential)
  • Remediation: System Settings > Network > Firewall > Turn On
  • Severity: Critical if disabled

FileVault

  • Check: fdesetup status
  • Expected: "FileVault is On."
  • Remediation: System Settings > Privacy & Security > FileVault > Turn On
  • Severity: Critical if disabled (disk not encrypted)

Open Ports

  • Check: lsof -iTCP -sTCP:LISTEN -nP
  • Review: unexpected services listening on all interfaces (0.0.0.0 or *)
  • Severity: Info (review needed, not automatically bad)

SSH Configuration

  • Check: /etc/ssh/sshd_config
  • Flags: PasswordAuthentication yes, PermitRootLogin yes
  • Remediation: Set to no and restart sshd
  • Severity: Warning

Remote Services

  • Remote Login: systemsetup -getremotelogin
  • Remote Management: defaults read /Library/Preferences/com.apple.RemoteManagement ARD_AllLocalUsers
  • Remediation: Disable in System Settings > General > Sharing
  • Severity: Info/Warning depending on context

Software Updates

  • Check: softwareupdate -l (can be slow, 30s timeout)
  • Remediation: System Settings > General > Software Update
  • Severity: Warning if updates available

Screen Lock

  • Check: defaults -currentHost read com.apple.screensaver idleTime
  • Check: defaults read com.apple.screensaver askForPassword
  • Remediation: System Settings > Lock Screen
  • Severity: Warning if password not required
Reference in New Issue View Git Blame Copy Permalink