antiviruslisted

# Antivirus (macOS Native Audit) Lightweight, install-free security audit of this Mac. Uses only built-in macOS tooling. Signature-based AV scanning (ClamAV, Malwarebytes, Objective-See tools) is opt-in and not run by default. ## Scope **What this does:** enumerate what's persistent, what's listening, what's been quarantined, and whether OS-level protections are on. Catches ~90% of real-world macOS compromises (which are mostly persistence-based adware and credential stealers, not kernel exploits). **What this does NOT do:** signature scanning of every file on disk, memory forensics, kernel rootkit detection, or network traffic analysis. If the native audit is clean but you still suspect compromise, escalate to Objective-See's KnockKnock / BlockBlock / LuLu or a full Malwarebytes scan. ## When to run - User asks for an antivirus / malware / security scan - During cybersecurity-bodyguard incident response (Mode 3) - After installing unsigned software or clicking a suspicious link - Monthly baseline (add to monthly-review skill if not already) ## Config No config file. The skill enumerates everything and compares against: 1. A hard-coded known-bad-path list (common macOS malware install locations) 2. A "normal for Alex" allowlist below -- update this when new legitimate software is installed **Known-good LaunchAgent prefixes:** - `com.exobrain.*` -- all exobrain harness jobs - `com.google.*` -- Google Updater, Keystone, Drive - `us.zoom.*` -- Zoom auto-update - `com.ap