A field guide to testing macOS security barriers.
Guides authorized testers through assessing and bypassing macOS security protections.
When to use it
Use when targeting macOS endpoints during authorized red-team or penetration-testing engagements that require bypassing security protections.
Give it an authorized macOS security-testing request; it provides guidance on bypass techniques for the relevant protections.
The testing target must be a macOS endpoint; individual techniques depend on its version and protections.
This skill
TCC.db
Reads macOS privacy permission records
/Applications/
Inspects installed app entitlements
running macOS processes
Inspects running process entitlements