sandbox-entitlements-auditor

name	sandbox-entitlements-auditor
description	Audit and recommend minimal sandbox entitlements for secure desktop applications
allowed-tools	Read, Grep, Glob, Bash
tags	["security","sandbox","entitlements","audit","macos"]
graph	{"domains":["domain:software-engineering"],"specializations":["specialization:desktop-development"],"skillAreas":["skill-area:application-security-testing","skill-area:desktop-system-integration"],"roles":["role:desktop-developer","role:fullstack-engineer"],"workflows":["workflow:feature-development","workflow:release-management"]}

sandbox-entitlements-auditor

Audit existing entitlements and recommend minimal sandbox permissions for secure desktop applications, primarily for macOS but applicable concepts for other platforms.

Capabilities

• Analyze current entitlements usage
• Detect over-permissioned configurations
• Recommend minimal entitlement sets
• Check for security anti-patterns
• Verify MAS compliance
• Generate audit reports

Input Schema

{
  "type": "object",
  "properties": {
    "projectPath": { "type": "string" },
    "entitlementsPath": { "type": "string" },
    "targetDistribution": { "enum": ["mas", "direct", "both"] }
  },
  "required": ["projectPath"]
}

Audit Checks

• Unnecessary file system access
• Broad network permissions when not needed
• Hardened runtime exceptions
• JIT compilation allowance
• Library validation disabling

Related Skills

• macos-entitlements-generator
• security-hardening process