Suspicious Download Review

Publisher description

Current runtime: this plugin runs unsandboxed with MacCrab's access. Any sandbox wording in the publisher's signed description below reflects an earlier design. The access disclosure on this page describes the current execution path.

Review current Downloads and launchd evidence after a suspicious download or pasted command. Collects top-level Downloads metadata and quarantine attributes plus supported user and system launchd configuration directories. Links a launch configuration only when its literal normalized absolute program path matches a current regular Downloads file. This is a path association, not proof of file identity, execution or causality.

Mach-O signing assessment remains explicitly unavailable: the collector does not validate signatures, notarization, trust or integrity. App bundles and installer/archive contents are not inspected. Program fields with whitespace or composite syntax are withheld as ambiguous, including legitimate paths with spaces. Missing, denied, malformed, changing and truncated sources remain visible.

The installed collector snapshots current state. Pasted-command review is limited to the opt-in developer --command-file mode, which emits fixed static indicators without retaining command text, URLs, arguments or environment values, and never executes input. No browser history, execution telemetry or remediation is included.

Paths, labels, timestamps and allowlisted identifiers can identify users and require encrypted scans. Actual current-user reads are limited in code despite the broader /Users manifest declaration. First-party plugins inherit host access; manifest capabilities are declarations, not an independent OS sandbox.

What it reads

Publisher-declared sources for this catalog entry. This list describes intended collection; it does not confine an unsandboxed plugin's file access. The published app's install screen may show older static descriptions rather than the publisher declarations shown here.

• Current user Downloads top-level entries (maximum 128)
• Current user Library/LaunchAgents and /Library/LaunchAgents + /Library/LaunchDaemons (maximum 64 entries each)
• com.apple.quarantine extended attributes on retained Downloads entries
• Explicit developer command file (optional; fixed indicators only)
• Four-byte Mach-O header check; signature assessment explicitly unavailable

Access and output privacy

Declared privacy requirements and the current execution path. Output classification describes what the plugin emits; it is separate from the files its process can read.

• Declared macOS access No privacy services listed
• Declared output Content data — requires an encrypted scan
• Runtime Trusted, unsandboxed process. MacCrab validates its Developer ID signature before execution. It inherits the host's privileges, including available Full Disk Access.
• Network The first-party execution path does not enforce an outbound-network block. A publisher's declaration of no network use is a behavior claim.

What it emits

Structured record types this plugin produces. Each row in your case database is one of these.

• clickfix_review.summary
• clickfix_review.download
• clickfix_review.persistence
• clickfix_review.path_link
• clickfix_review.command
• rave.collection

Community screenshots

Submitted by operators — moderated, and never catalog-authoritative (the signed catalog + sample output are the source of truth).

Verification for v0.1.0

Release checks recorded on 2026-09-28. These are the catalog's records for this version; this page does not perform a new independent build or collection test.

Source rebuild not applicable: this first-party entry does not publish a source repository for independent rebuilding. You can verify the publisher signature and pinned artifact digests against trusted keys. A recorded maintainer rebuild check does not provide independent source verification.

Revocation status comes from the signature-verified revocation list (serial 2), issued 2026-07-26. The website checks it during its build; MacCrab checks its own verified list when installing. The issue date does not describe the client's last successful fetch.

No revocation for v0.1.0 is recorded in that list.

Verify the signatures, artifact digests, and revocation list yourself.

Versions

Historical vetting is retained even when a release is revoked. “Current” identifies the version selected by the catalog.