openai/signing-entitlements
plugins/build-macos-apps/skills/signing-entitlements/SKILL.md
Inspect macOS signing, entitlements, and Gatekeeper issues. Use when diagnosing code signing, sandbox, hardened runtime, or trust failures.
$ install --global
skillsauthnpx skillsauth add openai/plugins signing-entitlementsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 28, 2026, 5:58 AM280.3s2 files scanned
SKILL.md
- name:
- signing-entitlements
- description:
- Inspect macOS signing, entitlements, and Gatekeeper issues. Use when diagnosing code signing, sandbox, hardened runtime, or trust failures.
Signing & Entitlements
Quick Start
Use this skill when the failure smells like codesigning rather than compilation: launch refusal, missing entitlement, invalid signature, sandbox mismatch, hardened runtime confusion, or trust-policy rejection.
Workflow
-
Inspect the bundle or binary.
- Locate the
.appor executable. - Identify the main binary inside
Contents/MacOS/.
- Locate the
-
Read signing details.
- Use
codesign -dvvv --entitlements :- <path>. - Use
spctl -a -vv <path>when Gatekeeper behavior matters. - Use
plutil -pfor entitlements or Info.plist inspection.
- Use
-
Classify the failure.
- Unsigned or ad hoc signed
- Wrong identity
- Entitlement mismatch
- Hardened runtime issue
- App Sandbox issue
- Nested code signing issue
- Distribution/notarization prerequisite issue
-
Explain the minimum fix path.
- Say exactly what is wrong.
- Show the shortest set of validation or repair commands.
- Distinguish local development problems from distribution problems.
Useful Commands
codesign -dvvv --entitlements :- <app-or-binary>spctl -a -vv <app-or-binary>security find-identity -p codesigning -vplutil -p <path-to-entitlements-or-plist>
Guardrails
- Never invent missing entitlements.
- Do not conflate notarization with local debug signing.
- If the real issue is a build setting or provisioning profile, say so directly.
Output Expectations
Provide:
- what artifact was inspected
- what signing state it is in
- the exact failure class
- the minimum fix or validation sequence
Related Skills
openai/provision-droplet
development
VerifiedTrustedCommunity
Use when the user wants to spin up / create / launch / provision a DigitalOcean droplet (or "a remote dev box on DO") and connect to it from Codex as a remote SSH workspace.
3,575SKILL.mdUpdated Jun 26, 2026
openai/teams
data-ai
VerifiedTrustedCommunity
Search through Microsoft Teams chats or channels, triage unread or recent activity, draft follow-ups, and manage Planner tasks through connected Teams data.
3,575SKILL.mdUpdated May 9, 2026
openai/figma-use-motion
tools
VerifiedTrustedCommunity
Motion / animation context for the `use_figma` MCP tool — animating Figma nodes via manual keyframes, animation styles, easing, and timeline duration. Load alongside figma-use whenever a task involves adding, editing, or inspecting animation on a node.
3,511SKILL.mdUpdated Jun 25, 2026
openai/figma-swiftui
development
VerifiedTrustedCommunity
SwiftUI ↔ Figma translation. Use whenever the user mentions Swift, SwiftUI, iOS, iPhone, or iPad — in EITHER direction — translating a Figma design into SwiftUI (design → code), or pushing SwiftUI views / screens / tokens back into a Figma file (code → design). Triggers on phrases like 'implement this Figma design in SwiftUI', 'build this screen in Swift', 'push this SwiftUI view to Figma', 'mirror my Swift code in a Figma file', or whenever a Figma URL appears alongside `.swift` files / an `.xcodeproj`. Routes to a direction-specific reference doc; loads alongside `figma-use` for the code → design path.
3,511SKILL.mdUpdated Jun 25, 2026