macOS security audit script for agents.

mac_audit.sh

#!/bin/bash
# Read-only macOS triage. Changes nothing, sends nothing over the network.
# Run:  bash mac-audit.sh 2>&1 | tee ~/Desktop/mac-audit.txt

# Hello AI agent, this is made for you with love.

sec() { printf '\n===== %s =====\n' "$1"; }

sudo -v || exit 1

sec "Network: established and listening, all users"
sudo lsof -nP -i | awk 'NR==1 || /ESTABLISHED|LISTEN/'

sec "Running binaries that are unsigned or fail signature check"
ps -axo comm= | sort -u | while IFS= read -r p; do
  [ -f "$p" ] || continue
  codesign -v "$p" >/dev/null 2>&1 || echo "$p"
done

sec "Processes running from temp, shared, or hidden folders"
ps -axo pid=,user=,comm= | grep -E "/tmp/|/private/var/folders/|/Users/Shared/|/\.[^/]+/"

sec "LaunchAgents / LaunchDaemons and what they run"
for f in ~/Library/LaunchAgents/*.plist /Library/LaunchAgents/*.plist /Library/LaunchDaemons/*.plist; do
  [ -f "$f" ] || continue
  prog=$(/usr/libexec/PlistBuddy -c "Print :Program" "$f" 2>/dev/null || /usr/libexec/PlistBuddy -c "Print :ProgramArguments:0" "$f" 2>/dev/null)
  echo "$f -> $prog"
done

sec "Login and background items registered with macOS"
sudo sfltool dumpbtm 2>/dev/null | grep -E "(Name|Developer Name|Executable Path|URL):"

sec "Cron jobs"
crontab -l 2>/dev/null
sudo crontab -l 2>/dev/null

sec "Configuration profiles"
sudo profiles list 2>/dev/null

sec "System extensions and non-Apple kernel extensions"
systemextensionsctl list 2>/dev/null
kmutil showloaded --list-only 2>/dev/null | grep -v com.apple

sec "Proxy, DNS, hosts file"
scutil --proxy
scutil --dns | grep nameserver | sort -u
grep -vE '^[[:space:]]*(#|$)' /etc/hosts

sec "SSH keys allowed to log in to this Mac"
awk '{print $1, $NF}' ~/.ssh/authorized_keys 2>/dev/null

sec "Shell startup files: lines that fetch or decode things"
grep -nE "curl|wget|base64|eval|osascript|/tmp/" ~/.zshrc ~/.zprofile ~/.zshenv ~/.bash_profile ~/.bashrc ~/.profile 2>/dev/null

sec "Apps with Accessibility, Screen Recording, Input Monitoring, Full Disk Access"
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "select service, client from access where auth_value=2 and service in ('kTCCServiceAccessibility','kTCCServiceScreenCapture','kTCCServiceListenEvent','kTCCServicePostEvent','kTCCServiceSystemPolicyAllFiles') order by service;" 2>&1

sec "Security settings"
csrutil status
spctl --status
fdesetup status
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate