# Use Objective See Tools

> Use installed Objective-See macOS security tools as evidence adapters. Use for KnockKnock, BlockBlock, LuLu, ProcessMonitor, FileMonitor, WhatsYourSign, TaskExplorer, or related tools with explicit permissions, limits, and ownership.

- Skill: `gaelic-ghost/use-objective-see-tools` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add gaelic-ghost/use-objective-see-tools`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gaelic-ghost/use-objective-see-tools/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: gaelic-ghost (https://skillmd.com/u/gaelic-ghost)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gaelic-ghost/use-objective-see-tools

---


# Use Objective-See Tools

## Overview

Select the Objective-See tool that observes the needed surface, record its current capabilities, and return evidence to the owning macOS workflow. Do not treat one tool's label or UI color as a threat verdict.

Read [references/objective-see-routing.md](references/objective-see-routing.md) and recheck the official tool page before use.

## Workflow

1. Name the unresolved observation: persistence, process, file, network, signing, or process inventory.
2. Discover local capability.
   - Verify official source, installed app/path, version, supported macOS build, permissions/system extensions, running state, and export format.
   - Do not install, approve extensions, or grant privacy access without an explicit operator decision.
3. Select one tool and bounded action.
4. Preserve context.
   - Record scan time, filters, exclusions, baseline, UI/CLI actions, alerts, raw/exported output, and tool errors.
5. Correlate independently.
   - Verify signer/path/hash, process ancestry, persistence registration, socket, or file change with native evidence where practical.
6. Route conclusions.
   - Send evidence to persistence, runtime, threat assessment, or containment workflows.

## Guardrails

- Do not enable blocking rules or terminate/delete items during evidence collection unless containment is separately approved.
- Do not claim historical coverage when the tool was installed after the event.
- Do not assume every Objective-See tool exposes a stable CLI or accessible GUI automation surface.

## Output

Return tool/version/capability, permissions, action, observations/export, independent correlation, limitations, and owning workflow.