Review and improve macOS defensive posture. Use for updates, XProtect and Gatekeeper, FileVault, firewall, remote access, accounts, background items, privacy, backups, credentials, and monitoring after a security assessment or incident.
Installs into .claude/skills of the current project.
Are you the author of Harden Macos?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/gaelic-ghost-harden-macos)
---
name: harden-macos
description: Review and improve macOS defensive posture. Use for updates, XProtect and Gatekeeper, FileVault, firewall, remote access, accounts, background items, privacy, backups, credentials, and monitoring after a security assessment or incident.
---
# Harden macOS
## Overview
Strengthen the actual exposure found on the Mac and verify each change. Preserve built-in protections, user access, recoverability, and organization management requirements.
Read [references/macos-hardening-review.md](references/macos-hardening-review.md) for a risk-ordered review.
## Workflow
1. Establish context.
- Record exact macOS build/hardware, device ownership/management, users, role, exposed services, sensitive data, backups, and the threat being reduced.
2. Apply supported updates.
- Verify OS, rapid/security data updates, browsers, extensions, apps, and package managers from authoritative channels.
3. Preserve platform protections.
- Verify Gatekeeper/XProtect automatic protection, SIP, TCC/privacy access, code-signing expectations, and sandbox/container use where applicable.
- Keep this defensive posture review separate from developer prompt/request implementation; route ordinary app permission design to `macos-privacy-permissions-workflow`.
4. Protect data and recovery.
- Review FileVault/recovery ownership, screen lock, backup availability and restore testing, account separation, and secure disposal/export practices.
5. Reduce exposed services and persistence.
- Review sharing, remote login/management, firewall policy, listeners, login/background items, profiles, system/network/browser extensions, and privileged helpers.
6. Improve identity/browser behavior.
- Review MFA, password manager use, recovery methods, session/token hygiene, download sources, extensions, phishing-resistant habits, and administrator use.
7. Add proportionate visibility.
- Define which alerts/logs or endpoint tooling are maintained, who reviews them, and how false positives are handled.
8. Verify and document.
- Re-read changed settings, test access/recovery, record exceptions and owner, and avoid claiming perfect prevention.
## Output
Return baseline, prioritized changes, applied/verified settings, deferred items and tradeoffs, recovery check, and residual risk.
