macos-security

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

macos-security

macOS安全防护

Purpose

用途

This skill enables the AI agent to manage macOS security features, including XProtect for malware detection, MRT for removal, TCC for privacy permissions, quarantine attributes, code signing validation, and security audits. Use it to harden macOS systems against threats and ensure compliance.

该技能支持AI Agent管理macOS安全功能，包括用于恶意软件检测的XProtect、用于威胁清除的MRT、用于隐私权限管控的TCC、隔离属性、代码签名验证以及安全审计。可通过它强化macOS系统的威胁防御能力，确保合规性。

When to Use

适用场景

Apply this skill during system hardening routines, app deployment checks, privacy audits, or malware scans. Use it for new macOS setups, software installations, or when troubleshooting security issues like unauthorized app access or unsigned binaries.

可在系统加固流程、应用部署检查、隐私审计或恶意软件扫描时使用该技能。适用于全新macOS系统配置、软件安装，或排查未授权应用访问、无签名二进制文件等安全问题的场景。

Key Capabilities

核心能力

Detect malware via XProtect by querying the latest definitions and scanning files.
Run MRT to remove known threats from the system.
Manage TCC permissions to control app access to sensitive data like camera or contacts.
Inspect and remove quarantine flags on downloaded files to allow execution.
Validate code signing for apps to ensure they are from trusted developers.
Perform security audits using system logs to identify potential breaches.

通过查询最新病毒库并扫描文件，借助XProtect检测恶意软件。
运行MRT清除系统中的已知威胁。
管理TCC权限，控制应用对摄像头、通讯录等敏感数据的访问权限。
检查并移除下载文件的隔离标记，允许其执行。
验证应用的代码签名，确保其来自可信开发者。
通过系统日志执行安全审计，识别潜在的入侵行为。

Usage Patterns

使用模式

Invoke this skill in scripts for automated hardening, e.g., during VM provisioning or CI/CD pipelines for macOS apps. Use it reactively for incident response or proactively in scheduled tasks. For AI agents, call it via function wrappers that handle macOS-specific commands, ensuring elevated privileges with

sudo

where needed. Pattern: Check security status first, then apply fixes.

可在自动化加固脚本中调用该技能，例如在虚拟机配置过程中，或macOS应用的CI/CD流水线中。可用于事件响应的被动处理，也可作为定时任务主动执行。对于AI Agent，可通过封装macOS特定命令的函数调用它，确保在需要时使用

sudo

获取提升权限。使用模式：先检查安全状态，再应用修复措施。

Common Commands/API

常用命令/API

Use these macOS CLI commands for security tasks. All require admin privileges; check for errors via exit codes.

XProtect scan: Use

softwareupdate --list

to check for updates, then

xprotect scan /path/to/file

(via internal tools). Example snippet:

system("softwareupdate --list");
if (exit_code != 0) { handle_error("Update check failed"); }

MRT removal: Run

/usr/libexec/MRTConfigData remove

to trigger malware removal. Example snippet:

system("/usr/libexec/MRTConfigData remove");
print("MRT executed; check logs for results.");

TCC permissions: Use

tccutil reset <service> <app>

to reset or

tccutil set <service> <app> allow

to grant. Example:

tccutil set Camera com.example.app allow

for camera access.

Quarantine handling: Check with

xattr -l /path/to/file

and remove via

xattr -d com.apple.quarantine /path/to/file

. Example snippet:

xattr -l /path/to/file;
if (grep("com.apple.quarantine")) { system("xattr -d com.apple.quarantine /path/to/file"); }

Code signing validation: Run
```
codesign -vvv --verify --strict /path/to/app
```
to check signatures. Example:
```
codesign -dvvv /Applications/MyApp.app
```
for detailed verification.
Security audit: Query logs with
```
log show --predicate 'subsystem == "com.apple.securityd"' --last 1h
```
. Config format: Use predicates in
```
log
```
command for filtering, e.g., JSON output via
```
--style json
```
.

If API keys are needed (e.g., for third-party security tools), use env vars like

$SECURITY_API_KEY

in scripts:

curl -H "Authorization: Bearer $SECURITY_API_KEY" https://api.example.com/scan

使用以下macOS CLI命令执行安全任务。所有命令均需要管理员权限；可通过退出码检查错误。

XProtect扫描：使用

softwareupdate --list

检查更新，然后通过内部工具执行

xprotect scan /path/to/file

。示例代码片段：

system("softwareupdate --list");
if (exit_code != 0) { handle_error("Update check failed"); }

MRT威胁清除：运行

/usr/libexec/MRTConfigData remove

触发恶意软件清除。示例代码片段：

system("/usr/libexec/MRTConfigData remove");
print("MRT executed; check logs for results.");

TCC权限管理：使用
```
tccutil reset <service> <app>
```
重置权限，或使用
```
tccutil set <service> <app> allow
```
授予权限。示例：
```
tccutil set Camera com.example.app allow
```
用于授予摄像头访问权限。

隔离机制处理：使用

xattr -l /path/to/file

检查隔离标记，通过

xattr -d com.apple.quarantine /path/to/file

移除标记。示例代码片段：

xattr -l /path/to/file;
if (grep("com.apple.quarantine")) { system("xattr -d com.apple.quarantine /path/to/file"); }

代码签名验证：运行

codesign -vvv --verify --strict /path/to/app

检查签名。示例：

codesign -dvvv /Applications/MyApp.app

用于详细验证。

安全审计：使用
```
log show --predicate 'subsystem == "com.apple.securityd"' --last 1h
```
查询日志。配置格式：在
```
log
```
命令中使用谓词进行过滤，例如通过
```
--style json
```
输出JSON格式。

如果需要API密钥（例如第三方安全工具），可在脚本中使用环境变量如

$SECURITY_API_KEY

：

curl -H "Authorization: Bearer $SECURITY_API_KEY" https://api.example.com/scan

。

Integration Notes

集成说明

Integrate by wrapping commands in AI agent functions, e.g., use Python's subprocess to call

tccutil

. For automation, combine with tools like Jamf or MDM APIs. Ensure the agent runs with sufficient privileges; use

osascript

for user prompts if needed. Config files like

/etc/authorization

can be edited for TCC policies, but back them up first. Test integrations in a sandboxed macOS environment to avoid disruptions.

可通过将命令封装到AI Agent函数中实现集成，例如使用Python的subprocess调用

tccutil

。对于自动化场景，可与Jamf或MDM API结合使用。确保Agent拥有足够的权限；必要时使用

osascript

发起用户提示。可编辑

/etc/authorization

等配置文件修改TCC策略，但修改前请先备份。在沙箱化的macOS环境中测试集成，避免造成系统中断。

Error Handling

错误处理

Always check command exit codes; for example, if

codesign

returns non-zero, log the error and suggest re-signing. Parse outputs for specific strings, e.g., if

tccutil

fails with "Access denied", prompt for admin elevation. Use try-catch in scripts:

try {
  system("tccutil set Camera com.example.app allow");
} catch (e) {
  if (e.includes("permission")) { system("sudo -u root tccutil set Camera com.example.app allow"); }
}

Common errors: Permission issues (use

sudo

), file not found (verify paths), or outdated XProtect (run updates first). Log all errors to

/var/log/securityd.log

for auditing.

始终检查命令的退出码；例如，如果

codesign

返回非零值，记录错误并建议重新签名。解析输出中的特定字符串，例如如果

tccutil

返回“Access denied”，提示获取管理员权限。在脚本中使用try-catch块：

try {
  system("tccutil set Camera com.example.app allow");
} catch (e) {
  if (e.includes("permission")) { system("sudo -u root tccutil set Camera com.example.app allow"); }
}

常见错误：权限问题（使用

sudo

解决）、文件未找到（验证路径）、XProtect版本过时（先执行更新）。将所有错误记录到

/var/log/securityd.log

以便审计。

Concrete Usage Examples

具体使用示例

Malware Scan and Removal: To scan a suspicious file and remove threats:
- First, update XProtect:
```
softwareupdate --install --all
```
  .
- Then run MRT:
```
system("/usr/libexec/MRTConfigData remove")
```
  .
- Verify:
```
log show --predicate 'eventMessage contains "MRT"'
```
  . This ensures the system is cleaned; handle errors by checking if MRT is available.
TCC Permission Management for an App: To grant camera access to a new app:
- Check current status:
```
tccutil reset Camera com.example.app
```
  .
- Grant permission:
```
tccutil set Camera com.example.app allow
```
  .
- Test: Run the app and confirm access. If errors occur, use
```
sudo
```
  and log the action for auditing.

恶意软件扫描与清除：扫描可疑文件并清除威胁：
- 首先，更新XProtect：
```
softwareupdate --install --all
```
  .
- 然后运行MRT：
```
system("/usr/libexec/MRTConfigData remove")
```
  .
- 验证：
```
log show --predicate 'eventMessage contains "MRT"'
```
  . 此流程可确保系统被清理；通过检查MRT是否可用处理错误。
应用TCC权限管理：为新应用授予摄像头访问权限：
- 检查当前状态：
```
tccutil reset Camera com.example.app
```
  .
- 授予权限：
```
tccutil set Camera com.example.app allow
```
  .
- 测试：运行应用并确认访问权限。如果出现错误，使用
```
sudo
```
  执行并记录操作以便审计。

Graph Relationships

关联关系

Related to: macos-filesystem (for handling quarantined files)
Depends on: macos-networking (for security audits involving network logs)
Conflicts with: none
Used by: general-security (as a subsystem for macOS-specific hardening)

关联：macos-filesystem（用于处理隔离文件）
依赖：macos-networking（用于涉及网络日志的安全审计）
冲突：无
被使用：general-security（作为macOS特定加固的子系统）