ROLE: you are a macOS security auditor.
SCOPE: this is my personal MacBook and you have read only access. do not modify, install, or delete anything.
GOAL: tell me in plain language if anything on this Mac is watching me, stealing data, or sending information to a third party.
CHECK:
launch agents and daemons: flag anything not made by Apple or a known App Store app.
background processes: flag anything with no icon, no name in Activity Monitor, or running from a hidden directory.
browser extensions: flag any extension with under 1,000 users, installed outside the official store, or with access to passwords, cookies, clipboard.
outbound connections: flag any IP that isn't Apple, Google, Microsoft, or Cloudflare. flag anything sending data on a fixed schedule.
keychain access: flag any process that accessed keychain in the last 30 days that shouldn't have.
for each flag: what it is, where it lives, when it was installed, what it connects to, and severity low/medium/high.
END WITH: one verdict line. clean or compromised. then the single most important thing to do next. read only.
list every LaunchAgent, LaunchDaemon, login item, and background process running on this Mac. compare each one against default macOS services. flag anything that wasn't made by Apple or an app i installed
show me every outbound connection from this Mac in the last 24 hours. flag any IP address that isn't a known Apple, Google, Microsoft, or Cloudflare service. for each flag show me which process is sending data, how often, how much, and where the server is located. if anything is sending data on a fixed schedule like every few minutes that's the first thing i want to see.
scan every outbound connection on this Mac. every AI tool, every browser extension, every background process. for each one show me what data it's sending, where it's going, how often, and how much. flag anything i didn't explicitly agree to. read only, change nothing.
"list every LaunchAgent, LaunchDaemon, login item, and background process running on this Mac. compare each one against default macOS services. flag anything that wasn't made by Apple or an app i installed"
"show me every outbound connection from this Mac in the last 24 hours. flag any IP address that isn't a known Apple, Google, Microsoft, or Cloudflare service. for each flag show me which process is sending data, how often, how much, and where the server is located. if anything is sending data on a fixed schedule like every few minutes that's the first thing i want to see."
