Catalog 8signed How we check

Forensic plugins for MacCrab.

Each plugin lists what it reads.
MacCrab checks its signature before it runs.

First-party plugins run unsandboxed with MacCrab’s access, including Full Disk Access, and MacCrab does not block their network use.

Something you’ve been handed.

A download, script, repo, binary, token or zip. Check it before you trust it.

  1. Suspicious Download Review

    Someone pasted a command. See what is new in Downloads and what is set to launch.

  2. Dependency Autopsy

    Find the install scripts hiding in an npm lockfile.

  3. Exit Check

    Check a zip for secrets before you send it.

  4. Repo Tripwire

    See what a repo is set to run the moment you open it.

  5. Script Trace

    Read an obfuscated shell script without running it.

  6. Secret Trail

    Find copies of a leaked token in config files, AI chats and shell history.

  7. Side Door

    See which libraries a binary says it will load, and from where.

  8. Skill Check

    Does this agent skill file want your credentials?

What’s on this Mac.

Nothing specific yet. See what is installed, listening and set to run.

  1. Agent Exposure

    See everything your coding agents are wired up to.

  2. Browser Trust

    What each browser extension asked for, and what it was actually given.

  3. Mac Security Posture Pro

    How hardened is this Mac, and what is set to run on it.

  4. Localhost Lens

    What is listening on this Mac right now.

  5. Remote Hands

    Is remote-control software set to start on its own?

What changed.

Compare two points in time. You will need the earlier one.

  1. Build Witness

    Did your build change between compile, sign and upload?

  2. Decoy

    Did anyone open the bait files you planted?

  3. Identity Aftershock

    Replay an Entra incident from its audit logs, offline.

  4. Last Good

    Pin down when something changed, between two snapshots.

  5. Trust Delta

    Compare an app before and after an update.

Put it together.

Combine reports from five of the plugins above.

  1. First Hour

    Pull your first findings into one report you can run again later.