persistence-audit SKILL.md skillA
persistence-audit from terrylica/cc-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add terrylica/cc-skills/persistence-audit@git:20260920.cb998c2Pins git:20260920.cb998c2 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- terrylica/cc-skills
- Path
plugins/macos-permissions/skills/persistence-audit/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260920.cb998c2, committed Sep 20, 2026
- Size
- 5,863 bytes
- Repository stars
- 2
- License
- MIT
Enumerate everything that persists or auto-starts on a Mac — launchd daemons and agents, Background Task Management items, system extensions, audio HAL plug-ins, SecurityAgentPlugins in the login chain, privileged helpers, kernel extensions, configuration profiles, login hooks, cron, listening sockets and firewall state. Enumerates rather than greps, so it finds what you did not think to search for. Use before uninstalling software, when hunting remote-access tools or unwanted background…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# persistence-audit — enumerate what persists, don't grep for it > **Self-Evolving skill** — if a macOS release adds or moves a persistence mechanism, add a section and record it here. ```bash SKILL="$(cc-plugin-root macos-permissions)/skills/persistence-audit" bash "$SKILL/persistence-inventory.sh" # everything readable as you sudo bash "$SKILL/persistence-inventory.sh" # adds root-only sections ``` Read-only. It deletes nothing. ## 🔴 Why enumerate instead of search Grepping for product names answers _"is X here?"_ and can never answer _"what is here?"_. In a real cleanup that searched for a handful of vendor names, a **root LaunchDaemon was running the entire time** and was missed — nobody typed its name. The same run also checked for `/Applications/<Vendor>.app` when the bundle was actually named `<Vendor> Helper.app` — a confident false negative. **Checking for a name you guessed at is not a test.** List what exists, then classify. ## 🔴 launchd addresses jobs by the Label INSIDE the plist, never the filename A vendor plist named `com.vendor.vendor_service.plist` can carry `Label com.vendor.service`. So: ```bash …
Read the whole file at its exact version.
How to install
mdr add terrylica/cc-skills/persistence-audit@sha256:386937b9ea86c39cThe line at the top of this page pins the label git:20260920.cb998c2, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_w34pqe7x32qrl4of)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 20, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5863 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
terrylica/cc-skills · 2 stars · license MIT · pushed 2026-11-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_w34pqe7x32qrl4of GET https://markdownregistry.com/api/v1/resolve?ref=terrylica/cc-skills/persistence-audit GET https://markdownregistry.com/api/v1/blob/386937b9ea86c39c0590125c98544ccd79ee2bc2edca48c0986b61247fa8fbbf
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.