How do I install the Misardefender skill?

Run npx skillmds@latest add aibot88/misardefender in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Misardefender safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Misardefender?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Misardefender free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Misardefender?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Misardefender by aibot88 — Agent Skill

Name: Misardefender
Rating: 4.5 (4 reviews)
Author: aibot88

Misardefender

Manage and interact with MisarDefender — the local macOS security daemon. Use when: checking security daemon status, viewing security events, starting/stopping defender, scanning for threats, checking file integrity, reviewing network activity logs. Triggers: 'defender', 'misardefender', 'security daemon', 'check threats', 'file integrity', 'security events', 'defender status'.

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

MisarDefender

MisarDefender is a local macOS security daemon that monitors file integrity, network activity, processes, credentials, USB devices, and app signatures. Alerts via macOS Notification Center.

Source: scripts/misardefender/defender.py Stack: Python 3.9+ · SQLite (defender.db) · launchd · localhost:9876 dashboard

Architecture — 6 Security Layers

Layer	Monitors
1 — File Integrity	SHA-256 hashes of critical paths (SSH, Keychain, LaunchAgents)
2 — Network	Outbound connections, suspicious domains
3 — Process	Running processes against whitelist, suspicious patterns
4 — Credential	Keychain access, credential exposure
5 — USB	Device attach/detach events
6 — App Integrity	Code signature validation

Commands

python3 scripts/misardefender/defender.py start      # Start daemon (launchd)
python3 scripts/misardefender/defender.py stop       # Stop daemon
python3 scripts/misardefender/defender.py status     # Check daemon status
python3 scripts/misardefender/defender.py scan       # One-shot manual scan
open http://localhost:9876                           # Open dashboard

Usage

/misar-dev:misardefender                   # Show status + recent events
/misar-dev:misardefender start             # Start the daemon
/misar-dev:misardefender stop              # Stop the daemon
/misar-dev:misardefender status            # Daemon status
/misar-dev:misardefender scan              # Run a manual scan
/misar-dev:misardefender logs              # Show recent security events
/misar-dev:misardefender dashboard         # Open localhost:9876

Instructions

When invoked:

Parse the argument (start / stop / status / scan / logs / dashboard)
For status: run python3 scripts/misardefender/defender.py status and summarize
For logs: query defender.db events table — show last 20 events ordered by timestamp
For start / stop / scan: run the corresponding command and report result
For dashboard: open http://localhost:9876 via Bash
No arg: show status + last 5 critical/high events

Security Notes

defender.db and defender.log are runtime files — never commit them
Daemon runs as local user (not root) — some monitors may have limited visibility
Touch ID authentication is handled by a companion Swift binary
All SQLite writes are local-only; no network exfiltration

---name: misardefenderdescription: Manage and interact with MisarDefender — the local macOS security daemon. Use when: checking security daemon status, viewing security events, starting/stopping defender, scanning for threats, checking file integrity, reviewing network activity logs. Triggers: 'defender', 'misardefender', 'security daemon', 'check threats', 'file integrity', 'security events', 'defender status'.--- # MisarDefender MisarDefender is a local macOS security daemon that monitors file integrity, network activity, processes, credentials, USB devices, and app signatures. Alerts via macOS Notification Center. **Source**: `scripts/misardefender/defender.py` **Stack**: Python 3.9+ · SQLite (`defender.db`) · launchd · localhost:9876 dashboard ## Architecture — 6 Security Layers | Layer | Monitors | |-------|----------| | 1 — File Integrity | SHA-256 hashes of critical paths (SSH, Keychain, LaunchAgents) | | 2 — Network | Outbound connections, suspicious domains | | 3 — Process | Running processes against whitelist, suspicious patterns | | 4 — Credential | Keychain access, credential exposure | | 5 — USB | Device attach/detach events | | 6 — App Integrity | Code signature validation | ## Commands ```bash python3 scripts/misardefender/defender.py start # Start daemon (launchd) python3 scripts/misardefender/defender.py stop # Stop daemon python3 scripts/misardefender/defender.py status # Check daemon status python3 scripts/misardefender/defender.py scan # One-shot manual scan open http://localhost:9876 # Open dashboard ``` ## Usage ``` /misar-dev:misardefender # Show status + recent events /misar-dev:misardefender start # Start the daemon /misar-dev:misardefender stop # Stop the daemon /misar-dev:misardefender status # Daemon status /misar-dev:misardefender scan # Run a manual scan /misar-dev:misardefender logs # Show recent security events /misar-dev:misardefender dashboard # Open localhost:9876 ``` ## Instructions When invoked: 1. **Parse the argument** (start / stop / status / scan / logs / dashboard) 2. For `status`: run `python3 scripts/misardefender/defender.py status` and summarize 3. For `logs`: query `defender.db` events table — show last 20 events ordered by timestamp 4. For `start` / `stop` / `scan`: run the corresponding command and report result 5. For `dashboard`: open `http://localhost:9876` via Bash 6. No arg: show status + last 5 critical/high events ## Security Notes - `defender.db` and `defender.log` are runtime files — never commit them - Daemon runs as local user (not root) — some monitors may have limited visibility - Touch ID authentication is handled by a companion Swift binary - All SQLite writes are local-only; no network exfiltration

Frequently asked questions