From mac-security-suite
macOS hardening audit — runs Lynis for a hardening-index score, optionally an mSCP (NIST/CIS) audit-only compliance check, verifies GUI guardians (BlockBlock/OverSight/ RansomWhere) are present, and produces a prioritized, drduh-aligned checklist of RECOMMENDED (never auto-applied) actions. Read-only / audit-only. Invoke with /mac-security:harden. Trigger phrases: "harden my mac", "hardening audit", "lynis", "cis benchmark", "security posture checklist", "am I hardened".
How this skill is triggered — by the user, by Claude, or both
Slash command
/mac-security-suite:hardenThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Audit-only hardening advisor. It scores posture and proposes a checklist; it never applies
Audit-only hardening advisor. It scores posture and proposes a checklist; it never applies
fixes (mSCP --fix is invasive and must stay a human decision on a personal machine).
Threat-model-first, aligned with the drduh macOS Security & Privacy guide and NIST mSCP.
bash ${CLAUDE_PLUGIN_ROOT}/bin/install-tools.sh # confirms lynis
bash ${CLAUDE_PLUGIN_ROOT}/skills/harden/scripts/harden.sh
Read-only posture audit: core controls, remote access, GUI-guardian presence, and Lynis
index if installed. For full Lynis coverage, follow up with sudo lynis audit system.
csrutil status # SIP
spctl --status # Gatekeeper
fdesetup status # FileVault
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate --getstealthmode
sudo systemsetup -getremotelogin # Remote Login (SSH)
sudo lynis audit system
Parse /var/log/lynis-report.dat (key=value). Pull the hardening index and any
warning[] / suggestion[] lines. Track the index over time across runs.*_compliance.sh from usnistgov/macos_security and run it
with --check ONLY. Never --fix unattended.A prioritized checklist: control → current state → recommended action → effort. Lead with high-ROI, low-friction items (FileVault, firewall stealth mode, DNS hygiene) before high-friction ones. Mark each as recommended, not applied. Note the drduh stance where it diverges from CIS (e.g. drduh is skeptical of resident AV and Santa on a personal Mac).
--fix or mutates system settings. Every item is a
recommendation the user executes./var/log/lynis-report.dat; mSCP cloned at runtime if used.)npx claudepluginhub ejkaz/claude-mac-security --plugin mac-security-suiteProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.