# Inspect Macos Persistence

> Inspect macOS persistence and recurring execution without deleting evidence. Use for login items, launch agents or daemons, extensions, profiles, shell startup files, scheduled tasks, browser extensions, helpers, and startup behavior.

- Skill: `gaelic-ghost/inspect-macos-persistence` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/inspect-macos-persistence`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/inspect-macos-persistence/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/inspect-macos-persistence

---


# Inspect macOS Persistence

## Overview

Inventory registered and file-backed persistence, then correlate it with loaded runtime state and installation history. Read files and official service state; never manage launchd by editing its internal state.

Read [references/macos-persistence-surfaces.md](references/macos-persistence-surfaces.md) for prioritized surfaces and evidence fields.

## Workflow

1. Record host/build, user domains, event timeline, and the suspected executable or label.
   - Record whether the system is a physical Mac or macOS guest, plus the guest's restore image/build, VM tool/framework, integrations, baseline/reset state, and known virtualization artifacts.
2. Inventory user-visible registrations.
   - Review Login Items and background-item state, profiles, extensions, browser add-ons, and app-managed helpers.
3. Inventory launch services.
   - Inspect user/system LaunchAgents and LaunchDaemons as files and query service state through `launchctl` read operations.
   - Record label, domain, program/arguments, working directory, environment, sockets, keep-alive/start conditions, owner/permissions, signer, and loaded PID/status.
4. Inspect adjacent persistence.
   - Review shell startup files, scheduled jobs, package receipts/scripts, privileged helpers, system/network extensions, authorization plugins, and current platform-specific surfaces justified by evidence.
5. Correlate provenance and runtime.
   - Identify parent installer/app, creation/change time, signature/notarization, executable hash, running process ancestry, files, network, and logs.
6. Classify each item.
   - Expected, suspicious, confirmed malicious, disabled/orphaned, or unresolved; explain evidence and impact.
   - Keep guest-observed persistence distinct from physical-host proof when anti-VM, hardware, recoveryOS, kernel/system-extension, or device behavior may differ.
7. Preserve before containment.
   - Record files and service state before using official `launchctl bootout` or app/uninstaller paths in the containment workflow.

## Output

Return a persistence inventory, loaded-versus-file state, provenance, runtime correlation, classification/confidence, and safe containment handoff.