Menu
Generate entitlements.plist with appropriate sandbox capabilities for macOS applications
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/a5c-ai/babysitter --skill macos-entitlements-generatorThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Based on SOC occupation classification
Reference for querying the Atlas knowledge graph through its MCP tools — the SECONDARY enrichment/comparison layer that adds best-practice context to systems you have ALREADY scanned from your real sources (`az`, repos, dirs). Use when you need to look up nodes, edges, kinds, clusters, stats, or wiki pages in Atlas to compare against your real inventory. (atlas graph, query atlas, atlas mcp, search the graph, graph neighbors, atlas record, atlas kinds, enrichment layer)
Atlas turns your STATED NEED into a real systems atlas by SCANNING your actual sources (Azure via `az`, git repos, local dirs) and process/data mining them, THEN enriching against the Atlas knowledge graph. Use this skill when asked to inventory/map your real systems, scan your cloud + repos + directories, mine the real processes or data they contain, or collect their real constraints/gotchas. (atlas, scan my systems, inventory our azure account, map my repos, real systems atlas, process mining, data mining, collect nuances, system discovery)
This skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
| name | macos-entitlements-generator |
| description | Generate entitlements.plist with appropriate sandbox capabilities for macOS applications |
| allowed-tools | Read, Write, Edit, Bash, Glob, Grep |
| tags | ["macos","entitlements","sandbox","security","apple"] |
| graph | {"domains":["domain:software-engineering"],"specializations":["specialization:desktop-development"],"skillAreas":["skill-area:desktop-system-integration","skill-area:application-security-testing"],"roles":["role:desktop-developer","role:fullstack-engineer"],"workflows":["workflow:feature-development","workflow:release-management"]} |
Generate entitlements.plist with appropriate sandbox capabilities for macOS applications. This skill configures the App Sandbox, hardened runtime, and specific entitlements required for app functionality.
{
"type": "object",
"properties": {
"projectPath": {
"type": "string",
"description": "Path to the Xcode project"
},
"appFeatures": {
"type": "array",
"items": {
"enum": [
"network-client", "network-server",
"file-read", "file-write",
"downloads-read", "downloads-write",
"pictures-read", "pictures-write",
"music-read", "music-write",
"movies-read", "movies-write"
{
"type": "object",
"properties": {
"success": { "type": "boolean" },
"files": {
"type": "array",
"items": {
"type": "object",
"properties": {
"path": { "type": "string" },
"type": { "enum": ["entitlements", "info-plist-additions"] }
}
}
},
"warnings":
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- App Sandbox -->
<key>com.apple.security.app-sandbox</key>
<true/>
<!-- Network access -->
<key>com.apple.security.network.client</key>
<true/>
<!-- User-selected files (via Open/Save panels) -->
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<!-- Camera access -->
<key>com.apple.security.device.camera</key>
<true/>
<!-- Microphone access -->
<key>com.apple.security.device.microphone</key>
<true/>
<!-- Network for streaming -->
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<!-- Save recordings -->
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.files.movies.read-write
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<!-- JIT compilation (NOT allowed in Mac App Store) -->
<key>com.apple.security.cs.allow-jit</key>
<true/>
<!-- Disable library validation for plugins -->
<key>com.apple.security.cs.disable-library-validation</key>
<true/>
<!-- File access -->
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<!-- Hardened runtime (required for notarization) -->
<key>com.apple.security.cs.allow-jit</key>
<false/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<false/>
<key>com.apple.security.cs.disable-library-validation</key>
<false/>
<!-- App-specific needs -->
<key>com.apple.security.automation.apple-events</key>
<true/>
<key>com.apple.security.device.audio-input</key>
<true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<!-- App Groups for sharing data with extensions -->
<key>com.apple.security.application-groups</key>
<array>
<string>$(TeamIdentifierPrefix)com.mycompany.myapp</string>
</array>
<!-- Keychain access groups -->
<key>keychain-access-groups</key>
<array>
<string>$(AppIdentifierPrefix)com.mycompany.myapp</string>
</array>
<key>com.apple.security.network.client</key>
<true/>
</dict>
</plist>
| Key | Description |
|---|---|
files.user-selected.read-only | Read user-selected files |
files.user-selected.read-write | Read/write user-selected files |
files.downloads.read-only | Read Downloads folder |
files.downloads.read-write | Read/write Downloads folder |
files.pictures.read-only | Read Pictures folder |
files.music.read-only | Read Music folder |
files.movies.read-only | Read Movies folder |
| Key | Description |
|---|---|
network.client | Outgoing connections |
network.server | Incoming connections |
| Key | Description |
|---|---|
device.camera | Camera access |
device.microphone | Microphone access |
device.usb | USB device access |
device.bluetooth | Bluetooth access |
print | Printing |
| Key | Description |
|---|---|
cs.allow-jit | Allow JIT compilation |
cs.allow-unsigned-executable-memory | Allow unsigned executable memory |
cs.disable-library-validation | Load arbitrary plugins |
cs.disable-executable-page-protection | Disable W^X |
When using certain entitlements, add corresponding privacy descriptions:
<!-- Info.plist additions -->
<key>NSCameraUsageDescription</key>
<string>This app needs camera access for video calls.</string>
<key>NSMicrophoneUsageDescription</key>
<string>This app needs microphone access for audio recording.</string>
<key>NSAppleEventsUsageDescription</key>
<string>This app needs to control other applications for automation.</string>
<key>NSLocationUsageDescription</key>
<string>This app needs your location for local weather.</string>
macos-notarization-workflow - Code signing and notarizationmacos-codesign-workflow - Code signingsecurity-hardening process - Security auditswiftui-macos-expert - macOS developmentdesktop-security-auditor - Security review