# Detection catalogue

> Every check Cloak Watch runs, by ID, with what it looks for, the tier it raises, how it avoids false alarms, and what to do when one fires.

Source: https://docs.subcloak.com/cloak-watch/detections/

Cloak Watch runs four kinds of checks. **Feed matches** compare your inventory with the signed feed's list of known malicious versions, Subcloak's incident packs and the feed's list of exploited flaws. **Built-in checks** look for the shapes attacks leave behind, such as a hook that runs a hidden script or a workflow that leaks secrets, so they can catch the next attack before any feed names it. **Headline checks** answer [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/) for each headline and raise a card when this Mac is affected. **Checks beyond this Mac** look at your [GitHub](https://docs.subcloak.com/cloak-watch/github/) account and the [domains](https://docs.subcloak.com/cloak-watch/domains/) you add, only when you turn them on. Every check on the Mac reads files and metadata only; none runs package code, scripts, MCP servers or `git`. The few exceptions that ask a program something, such as Safari's extension list or a container engine's image list, are noted where they apply.

Each check has an ID. You see it under **Details › Checks that found it** on an incident page. Every check and every fix is free on every plan. **Learn more** on an incident opens its write-up on [headlines.subcloak.com](https://headlines.subcloak.com) when a headline covers it, and otherwise this page at the check's ID.

## Tiers and the starting point

Each check raises an incident in one of three [tiers](https://docs.subcloak.com/cloak-watch/inbox/#alert-tiers): **Act now** (shown as Fix now), **Review** (Worth a look) or **FYI** (Good to know).

The first scan records a starting point. Review and FYI findings from built-in checks about what was already on your Mac then join a quiet baseline: they don't show in the Inbox or notify you, and Watch tells you about changes since. Anything at **Act now** always alerts, on day one too, whether a built-in check or a feed match found it. Feed matches at any tier always alert. Reset the starting point in [Settings › Advanced](https://docs.subcloak.com/cloak-watch/settings/#advanced).

## Packages (PKG)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| PKG-1 | A package version on the feed: in a lockfile, installed in a project, installed globally, or in a download cache. Matches an incident pack's affected versions, or the feed's index of malicious versions. | **Act now** when it's installed or cached. **Review** when only a lockfile pins it ("Only a lockfile pins it: nothing is installed or cached yet."). Suspected packs are at most Review. | Exact name and version only. The incident says whether the version arrived inside the window when the bad version was available; that doesn't change the tier. |
| PKG-2 | A file whose SHA-256 matches a known malware file from an incident pack or Watch's built-in list. | Act now | Exact hash only. |
| PKG-3 | Known payload file names inside a package folder: `setup.mjs`, `Math_Symbol.js`, `setup_bun.js`, `bun_environment.js`. | **Act now** when the file's content matches a known payload. **Review** when only the name matches (except `setup.mjs`, which needs the content). | Content check, not the name alone. |
| PKG-4 | A Python startup file (a `.pth` file, `sitecustomize.py`, `usercustomize.py`, or a `.start` file and the code it calls) with a known attack file name, or code that downloads, decodes or starts programs, such as `base64`, `urlopen`, `os.system`, `Popen(` or `curl`. Python runs these every time it starts. Fix: Watch moves the file to Quarantine, and Python stops running it at once; then recreate the affected Python environments. | Act now | Common harmless `.pth` files are allowed (editable installs, setuptools, virtualenv, coverage and similar). Other startup code is [PER-7](#per-7) at Review. |
| PKG-5 | An installed package whose `preinstall`, `install` or `postinstall` script runs a file over 100 KB or downloads a runtime such as Bun. | Review | About 70 packages that legitimately build or download at install (esbuild, sharp, Prisma, SWC and similar) are allowed. |
| PKG-6 | A `bun` binary or `bun-v*.zip` in your temporary folder or Downloads, or a `tmp.dpkg_*.lock` file in the temporary folder. | Review; **Act now** when a PKG-3 payload is also present | Bun installed with Homebrew or in `~/.bun` isn't flagged. |
| PKG-7 | A package registry or index in your settings (`.npmrc`, `pip.conf`, Cargo config, `.gemrc` and others) that isn't a known public registry. | Review | Company mirrors show here too: mark the incident not a problem once. An index added with `extra-index-url` raises [REPO-10](#repo-10) instead. |
| PKG-8 | Install cooldowns, per tool: npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry and Bundler, each read from the version Watch finds and the file that version reads (per tool from 1.2.0). One card for tools with no cooldown, or whose version has none ("npm installs brand-new versions"), and one card for a cooldown you set that your version ignores ("A cooldown you set isn't being applied"), such as npm older than 11.10, pip older than 26.0, uv older than 0.9.17, Yarn 1, or a Bun value under an hour. | FYI for no cooldown; **Review** for a cooldown that's ignored | Only tools on the Mac or named by a lockfile. pnpm 11 and Deno 2.9 wait a day by default and count as on. Fix it in [Install Guard](https://docs.subcloak.com/cloak-watch/install-guard/#cooldown-status-per-tool). |
| PKG-9 | GitHub Actions workflows in your projects that contain known attack strings (for example a step named "Run Copilot" or `toJSON(secrets)`). | Review | Only repositories in your code folders. Actions pinned by tag are [REPO-1](#repo-1) from 1.1. |
| PKG-10 (added in Cloak Watch 1.2.0) | A container image an incident pack names, by tag, digest or image ID, in a running container engine (Docker Desktop, OrbStack, Colima, Rancher Desktop or Podman). See [Container images](https://docs.subcloak.com/cloak-watch/container-images/). | From the pack | Images are read only while their engine runs. Watch asks the engine for its image list and each image's settings, nothing else. |
| PKG-11 (added in Cloak Watch 1.2.0) | A package manager setting that weakens a safe default: certificate checks off (`strict-ssl=false`, `NODE_TLS_REJECT_UNAUTHORIZED=0`, pip `trusted-host`, uv `allow-insecure-host`, `GOINSECURE`), Go's checksum database off (`GOSUMDB=off`, or `GONOSUMDB`, `GONOSUMCHECK` or `GOPRIVATE` set to `*`), every install script allowed (pnpm `dangerouslyAllowAllBuilds`, npm `allow-scripts=*`), or a cooldown set to 0. Title: "… weakens a package manager's safety setting". Also: "An install cooldown was removed" when a cooldown disappears between scans. | Review; FYI for `GOPROXY=direct`, Yarn `unsafeHttpWhitelist`, Cargo `replace-with` and npm `ignore-scripts=false` | Read from user and project config files and `export` lines in shell profiles. Turning a cooldown off in Install Guard doesn't raise the removed-cooldown card. Fix: remove the setting unless you need it. |

## Persistence (PER)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| PER-1 | A launch agent or daemon with a known attack label, such as `com.user.gh-token-monitor`, or one named in an incident pack. | Act now | Exact label. |
| PER-2 | A launch agent or daemon whose program is in `/tmp`, `/Library/Caches`, `/Users/Shared` or an unusual hidden folder in your home, or a `com.apple.*` label running from outside the system folders. | Review | Programs signed by Apple or with a Developer ID are skipped. Items already there at the starting point join the quiet baseline. |
| PER-3 | A known attack file at an exact path, such as stealer files in your home folder or `/Library/Caches`, or a file indicator from an incident pack. | Act now | Exact path; a pack's hash or content check, when it has one, must match too. |
| PER-4 | Shell profile lines that shut the Mac down, download and run a script, run `osascript`, decode base64, hold a long base64 blob, or add a hidden folder to `PATH`. | **Act now** for shutdown; Review for the rest | One incident per line. Review lines already there at the starting point join the quiet baseline; a shutdown line always alerts. |
| PER-5 | A global Git `core.hooksPath` pointing into a hidden folder, or an executable Git hook that makes network calls. | Review | Husky and lefthook layouts are allowed. |
| PER-6 | Commits authored as `claude@users.noreply.github.com` in a repository's history. | Review; **Act now** when the same repository also has an AGT-1 hook | Only the combination is urgent. |
| PER-7 (added in Cloak Watch 1.2.0) | Python startup code that isn't clearly harmful: an `import` line in a `.pth` file, a `sitecustomize.py` or `usercustomize.py` in site-packages, or a Python 3.15 `.start` file, in every Python Watch finds (Homebrew, python.org, the Command Line Tools and Xcode, pyenv, uv, conda, asdf, mise, pipx, Poetry, `~/Library/Python`, `~/.local` and project `venv`, `.venv`, `env` and `.env` folders). The card names the package that installed the file when its install record lists it. | Review | setuptools, virtualenv, editable installs, namespace packages, coverage and similar are allowed. Startup code that downloads, decodes or starts programs is [PKG-4](#pkg-4) at Act now. Fix: Quarantine the file, then reinstall the package from a version you trust if you need it. |

## AI agents (AGT)

"A repository you don't own" means a clone whose remote isn't you: not your GitHub login, not an owner of a repository you've committed to or pushed from on this Mac, and with no commits or pushes from this Mac. Folders with no Git remote are never treated as someone else's. See [AI agents and MCP](https://docs.subcloak.com/cloak-watch/ai-agents-and-mcp/).

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| AGT-1 | Hooks in Claude Code settings (`.claude/settings*.json`, plugins) that run `node`, `bash -c`, `curl`, `wget`, `python`, `osascript`, base64, `eval` or a hidden path. | **Act now** for known attack hooks; Review for the rest | Watch's own hook and Anthropic's official plugin marketplace are excluded. |
| AGT-2 | A `.vscode/tasks.json` task that runs when the folder opens (`runOn: folderOpen`). | **Act now** for a known attack task such as one labelled "Environment Setup"; Review otherwise | Review tasks already there at the starting point join the quiet baseline; a known attack task always alerts. |
| AGT-3 | Settings that send an AI tool's traffic somewhere else: a base-URL, proxy or certificate override that doesn't point at the provider, or an `apiKeyHelper` script. | Review; FYI for an `apiKeyHelper` in your user settings | Company gateways show here too: mark the incident not a problem. |
| AGT-4 | A project's Claude Code settings that approve its MCP servers in advance (`enableAllProjectMcpServers`, `enabledMcpjsonServers`). | Review | |
| AGT-5 | Broad allow rules such as `Bash(*)` or `*`, which let an agent run any command without asking. | FYI | |
| AGT-6 | Hidden text in rules files and skills (`CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `SKILL.md` and others): Unicode tag characters, three or more zero-width characters, or text-direction overrides. | **Act now** for tag characters; Review for zero-width characters and overrides | Flag emoji, which use tag characters, are allowed. |
| AGT-8 | AI tool login files present (Claude, Codex, Cursor, Gemini). Attacks increasingly collect them. | FYI | Presence only; Watch never reads them. |
| AGT-9 (added in Cloak Watch 1.2.0) | Tool approval turned off: Claude Code `permissions.defaultMode: "bypassPermissions"`, Codex `approval_policy = "never"` with `sandbox_mode = "danger-full-access"`, VS Code-family `chat.tools.global.autoApprove`, or a catch-all terminal auto-approve rule. "A cloned repo turns off …'s approval prompts" or "… runs commands without asking". | **Review** when a repository you don't own sets it in its shared project settings; FYI in your own settings | Specific allow rules such as `"npm test": true` aren't flagged. Watch never edits agent settings; the card names the key to remove. |
| AGT-10 (added in Cloak Watch 1.2.0) | A project's Claude Code or Codex settings that set the environment of the agent's commands: `PATH`, `BASH_ENV`, `NODE_OPTIONS`, `PYTHONPATH`, `GIT_SSH_COMMAND`, `DYLD_*` and similar. | Review; **Act now** when `PATH` reaches a folder inside the repository that holds its own `git`, `node`, `python`, `npm`, `sh` or similar ("A repo replaces the git or node that … runs") | |
| AGT-11 (added in Cloak Watch 1.2.0) | An AI tool or extension at a release an incident says was tampered with. | Review | Exact release. Fix: update. |
| DEV-1 (added in Cloak Watch 1.2.0) | A Dev Container `initializeCommand` in a repository you don't own ("A cloned repo's dev container runs a command on your Mac"). It runs on the Mac, not in the container, when an editor opens the folder. | Review; **Act now** when it downloads, decodes or pipes into a shell | Only `.devcontainer.json` and `.devcontainer/` files in repositories you don't own. |

## MCP servers (MCP)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| MCP-1 | An enabled MCP server whose command runs from a hidden folder, `/tmp`, a temporary folder, a file inside `node_modules`, or `sh -c` / `bash -c`; or a server an incident pack names. | Act now | Known tools' own folders are allowed. Act now, so it alerts even for a server that was already there at the starting point. |
| MCP-2 | An MCP server that launches a package version on the feed (through `npx`, `bunx`, `pnpm dlx`, `uvx`, `pipx`, `uv` or `docker`). | Act now; Review when the command doesn't pin a version and not every version is bad | Exact version. |
| MCP-3 | A new tool appearing on an MCP server that an agent already uses. Shown in AI Activity, from Claude Code's hooks. | Review | |
| MCP-5 | A tool result that reads like instructions to the model (prompt injection). Shown in AI Activity, from agent hooks; Claude Code and Codex are also told to treat the text as data. | Review | |
| MCP-6 (added in Cloak Watch 1.2.0) | A project MCP server (`.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, `.codex/config.toml`, `.gemini/settings.json` and others) in a repository you don't own ("A cloned repo brings its own MCP server"). | Review; **Act now** when the server runs from a hidden or temporary folder, a file inside `node_modules`, or an inline `sh -c` script | Turned-off servers are skipped. |
| MCP-7 (added in Cloak Watch 1.2.0) | A remote MCP server on a tunnel or throwaway host (ngrok, trycloudflare, webhook.site and similar) or a bare IP address, or one whose host changed since Watch first saw it. | Review | Local addresses are skipped. |
| MCP-8 (added in Cloak Watch 1.2.0) | An AI tool released before fixes for project config running before you trusted the folder: Cursor older than 1.3, Claude Code older than 1.0.111 or 2.1.196, Codex CLI older than 0.131.0 ("… can run a project's code before you trust it"). | Review | Fix: update, and until then don't open repositories you didn't write in it. |

## Extensions (EXT)

Watch reads extensions in VS Code, VS Code Insiders, Cursor, Windsurf, VSCodium, Kiro, Trae, Positron and Antigravity, JetBrains IDEs, Chromium browsers, Firefox and Safari. Each fix uses the editor's or browser's own uninstall. See [Extensions](https://docs.subcloak.com/cloak-watch/extensions/).

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| EXT-1 | An editor extension version on the feed, including Datadog's list of malicious editor extensions. Watch checks both the VS Code Marketplace and Open VSX IDs. | Act now | Exact ID and version, or the versions Datadog's samples name. |
| EXT-2 | An Open VSX extension (in Cursor, Windsurf and other non-VS Code editors) with the name of a popular extension but a different publisher, as copycat extensions do. | Review | Only a list of 32 popular names; trusted publishers are excluded. |
| EXT-3 | A browser extension on the feed, or on a community list of malicious extensions, matched by its ID. | Act now; **Review** when it's on a list but turned off in the browser | Exact ID and version. A list match's card names the list and its license. |
| EXT-4 (added in Cloak Watch 1.2.0) | An editor extension installed from a `.vsix` file whose publisher nothing else on the Mac vouches for ("Extension installed from a file, not a marketplace"). | Review | Platform vendors, publishers of popular extensions, and publishers with another extension from a marketplace are trusted. |
| EXT-5 (added in Cloak Watch 1.2.0) | An editor extension that pulls in another publisher's extension as a dependency or pack member, when that extension is installed in the same editor and isn't from a known vendor. | Review | |
| EXT-6 (added in Cloak Watch 1.2.0) | Hidden code: 32 or more invisible characters in a row (variation selectors, Unicode tag characters or zero-width characters) in an extension's shipped JavaScript ("Hidden code in the … extension"). GlassWorm hid its code this way. | **Act now**; Review for runs of 8 to 31 tag characters or variation selectors | An emoji's single selector never counts. Watch reads the entry files and the `.js` files at the top and in `out`, `dist`, `lib`, `src`, `client` and `build`, at most 12 files and 32 MB per extension. |
| EXT-7 (added in Cloak Watch 1.2.0) | The same extension ID installed in two editors from two different publishers, when the copies don't name the same source repository. | Review | |
| EXT-8 (added in Cloak Watch 1.2.0) | A JetBrains plugin (IntelliJ IDEA, PyCharm, WebStorm, GoLand, Rider, CLion, RustRover, Android Studio and others) at a version an incident pack names. | From the pack | Read from `META-INF/plugin.xml` inside each plugin. |
| EXT-9 (added in Cloak Watch 1.2.0) | A Chromium browser running an unpacked extension, or one added with `--load-extension` on the command line. | **Act now** from a hidden, temporary, cache or shared folder; Review otherwise; FYI for an unpacked extension inside one of your code folders (usually one you're building) | |
| EXT-10 (added in Cloak Watch 1.2.0) | A store-installed browser extension that updates from a server other than the store ("A browser extension updates from its own server"). | Review | Extensions installed by policy are skipped. |
| EXT-11 (added in Cloak Watch 1.2.0) | An extension Chrome flagged (its malware or policy verdict, Safe Browsing's blocklist, or the greylist) that is still turned on ("An extension Chrome flagged is still turned on"). | **Act now** when it was flagged as malware; Review otherwise | |
| EXT-12 (added in Cloak Watch 1.2.0) | A browser extension at a version an incident pack names, such as a hijacked release. | From the pack | Exact ID and version. |

## Skills (SKL)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| SKL-1 | An agent skill on the feed, by file hash, content or name, or on Datadog's malicious agent-skill list, matched by where the skill came from: its GitHub owner, repository and folder (from 1.2.0). | Act now | Never matched by the repository alone. Fix: Watch moves the skill's folder to Quarantine, or only its `SKILL.md` when the folder holds other things, and asks you to check the rest. |
| SKL-2 | A `SKILL.md` whose instructions download and run something, such as `curl … \| bash` "prerequisites". | Review | |

## Secrets (SEC)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| SEC-1 | Keys and tokens saved in plain text: in shell profiles, `~/.env` and `.envrc`, `~/.gitconfig`, `~/.aws/config`, AI agent and MCP configs (including MCP `env` blocks and headers), rules files, and your projects' `.env` files. Types: AWS access keys, GitHub, GitLab, npm, PyPI, Hugging Face, Slack, Stripe, Anthropic, OpenAI and Google keys and tokens, private keys and JSON Web Tokens. | Review | One incident per file. Example and template files and obvious placeholders are skipped. Values are never stored: Watch keeps a masked form (the first four and last two characters and the length, or only the length for values under 24 characters and passwords). |
| SEC-2 | Shell history lines that download and run scripts, or reach known lure domains, as fake installer pages ask you to paste. | Review | Off in the app. Run it with [`watchctl scan --history`](https://docs.subcloak.com/cloak-watch/watchctl/#scan). Known installers (Homebrew, rustup, Bun, uv, Deno, Claude) are skipped. |
| SEC-3 (added in Cloak Watch 1.2.0) | What kind of credential each file holds. "Publish tokens are stored in plain text": npm, PyPI, crates.io and RubyGems tokens, the GitHub CLI's token outside the Keychain, and `~/.git-credentials`. "Long-lived keys a stealer would take": `AKIA` AWS access keys, SSH keys without a passphrase, static Kubernetes tokens and client keys, Google Cloud service-account keys and `~/.netrc` passwords. | **Review** for publish tokens, which worms use to spread; FYI for long-lived keys | Watch never shows or keeps the value. For SSH keys it reads only the key's header. The card lists what to rotate, GitHub first. |
| SEC-4 (added in Cloak Watch 1.2.0) | Keys in a project's git history, on every branch: about 220 patterns derived from Gitleaks. One card per repository ("2 keys in the git history of shopapp"), with each key masked, its file, line and commit, and whether it's still in the current files or only in history. | Review | Lockfiles, vendored code, `node_modules`, images and binaries are skipped. Turn it off in [Settings › Privacy](https://docs.subcloak.com/cloak-watch/settings/#privacy). See [Keys in git history](https://docs.subcloak.com/cloak-watch/git-history-secrets/). |

## Repositories and CI (REPO)

These checks read the GitHub Actions workflows, Git settings and package-manager settings in the local clones under your [code folders](https://docs.subcloak.com/cloak-watch/settings/#general), as files. Watch never runs `git` or a workflow. REPO-1 to REPO-7 are derived from the audits of [zizmor](https://github.com/zizmorcore/zizmor), a GitHub Actions security linter by William Woodruff, under the MIT License; the notice is in **Settings › Advanced**, under **Acknowledgements**: click **Show** next to **Third-party notices**.

REPO-1, REPO-4 and REPO-5 are hygiene findings: each is one FYI card for the whole Mac, with a row per workflow. The others are one Review card per repository.

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| REPO-1 | Workflows that use third-party actions by tag or branch instead of a full 40-character commit SHA ("Workflows use actions by tag, not by commit"). Based on zizmor's unpinned-uses. | FYI | GitHub's own `actions/*` and `github/*` actions may use tags. Local (`./`) and `docker://` steps are skipped. |
| REPO-2 | A `pull_request_target` or `workflow_run` workflow that checks out the pull request's own code (a `ref:` to the pull request's head, `refs/pull/…`, or `gh pr checkout`), so untrusted code runs with the repository's secrets. Based on zizmor's dangerous-triggers. | Review | Only those two triggers, and only with a checkout of the pull request's code. |
| REPO-3 | Text an attacker controls, such as an issue or pull request title or body, a comment or review body, a commit message or `github.head_ref`, put into a `run:` step or a github-script `script:` with `${{ }}` ("A workflow puts untrusted text into a shell command"). Based on zizmor's template-injection. | Review | Only `${{ }}` inside a script. Passing the value through `env:` and using `"$VAR"` is safe and isn't flagged. |
| REPO-4 | `permissions: write-all`, or no `permissions` at all in a workflow that forks can trigger (`pull_request_target`, `workflow_run`, `issue_comment`). Based on zizmor's excessive-permissions. | FYI | A missing `permissions` block is flagged only for those triggers. |
| REPO-5 | A release workflow (on `release`, or on `push` with `tags:`) that restores a cache: `actions/cache`, `Swatinem/rust-cache`, or a setup action's `cache:`. A cache another workflow wrote could reach what you publish. Based on zizmor's cache-poisoning. | FYI | Only workflows that publish. |
| REPO-6 | A workflow that uses an action that was compromised: `tj-actions/changed-files` at 45.0.7 or older (GHSA-mrrh-fwg8-r2c3), or `reviewdog/action-setup@v1` and the five reviewdog actions that use it (GHSA-qmg3-hpqr-gqvc). Based on zizmor's known-vulnerable-actions, as a built-in list. | Review | `tj-actions/changed-files` pinned by commit SHA isn't judged by version. The five reviewdog actions are flagged however they're pinned, as their advisory says. |
| REPO-7 | `ACTIONS_ALLOW_UNSECURE_COMMANDS` set to true, which turns back on workflow commands that let a step's output set variables and paths. Based on zizmor's insecure-commands. | Review | |
| REPO-8 | A token or password inside a remote URL, or a `url.<base>.insteadOf` rule, in a repository's `.git/config` ("A token is saved in a Git remote URL"). | Review | A user name alone (`git@`, `ada@`) and a variable such as `$TOKEN` aren't flagged. Watch keeps the remote's name, the host and the kind of credential, never the value. |
| REPO-9 | A Terraform state file (`*.tfstate` or `*.tfstate.backup`) in a project, at the top level or up to two folders down ("Terraform state is stored in a repository"). State holds the secrets Terraform manages in plain text. | Review | Watch notes the file's size and never opens it. `.terraform/terraform.tfstate`, the backend's own pointer file, isn't counted. |
| REPO-10 | pip told to search a second index with `extra-index-url` (in `pip.conf` in your home folder, `/etc` or a project, or `--extra-index-url` in a project's `requirements*.txt`), or uv told to merge indexes with `index-strategy = "unsafe-…"` in `uv.toml`. A public package with the same name as a private one can then win. | Review; FYI for well-known public indexes such as `download.pytorch.org` | |
| REPO-11 | An npm scope sent to a private registry in an `.npmrc` (for example `@shopapp:registry=…`), with a package of that scope in your projects that was resolved from the public registry, or that's at version 99 or higher ("A private package may have come from the public registry"). | Review | Vendors' own registries (`npm.fontawesome.com`, GitHub Packages) are skipped. |
| REPO-12 (added in Cloak Watch 1.2.0) | A workflow shaped like a documented attack ("A known malicious workflow is in …"): Shai-Hulud's `shai-hulud-workflow.yml`, a `discussion.yaml` backdoor where a self-hosted runner runs a Discussion's text, a workflow that sends `toJSON(secrets)` to an outside address, or GhostAction's "security audit" workflows. | Act now, even without a headline | Ordinary workflows that mention secrets don't match. Fix: delete the workflow, check the repository's Actions run history, and rotate the GitHub token and every workflow secret. |

To learn whether a headline's planted workflows are in your clones, see [repositories and workflows](https://docs.subcloak.com/cloak-watch/check-my-mac/#repositories-and-workflows) in Check my Mac.

## Git settings (GIT)

(added in Cloak Watch 1.2.0)

Git runs some programs its settings name, and AI agents and editors run `git status` in the background as soon as you open a project. A normal clone doesn't copy a repository's settings: they arrive with a `.git` folder from a zip, a synced folder or a shared drive. Watch reads every repository's `.git/config` in your code folders, its submodules' config, files that config includes, and bare repositories nested inside the project. It never runs Git and never changes its config: each card gives the `git config` command to run.

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| GIT-1 | A repository's own Git settings that name a program Git runs: `core.fsmonitor`, `core.pager`, `core.sshCommand`, `credential.helper`, diff and merge tools, filters and `core.hooksPath` ("…'s Git settings run a program when Git starts"). This was disclosed as GitSpawn in September 2026. If the repository has no record of being cloned, the card says so. | **Act now** when the program is inside the repository or in a temporary, shared or hidden folder, or the setting downloads or decodes something; Review for other programs Watch can't place; FYI when the config only includes a file from the repository | Editors, pagers, Git LFS, `gh`, credential managers and similar tools don't raise a card. For `core.fsmonitor` the card also gives `git config --global core.fsmonitor false`. |
| GIT-2 | Your global Git settings: trusting every repository (`safe.directory = *`), `protocol.file.allow = always`, `core.protectHFS` or `core.protectNTFS` turned off, or an include from a temporary or unusual folder ("Your global Git settings weaken a safety check"). | Review; **Act now** when a global or included file runs a suspicious program ("Your global Git settings run a suspicious program") | Reads `~/.gitconfig`, `~/.config/git/config`, `/etc/gitconfig`, Homebrew's gitconfig and their includes. |
| GIT-3 | A `.gitmodules` shaped like a known attack on `git clone` ("…'s submodules are shaped like a Git clone attack"): a submodule path ending in a hidden carriage return (CVE-2025-48384), a path through a symbolic link, including one that differs only in case (CVE-2024-32002), an `update = !command` line, or a URL starting with `-`. | Review; **Act now** when the link points into `.git` | The card says which Git versions fix the bugs (2.45.1 and 2.50.1, and matching point releases) and not to clone it with `--recursive`. |

## Runners (RUN)

(added in Cloak Watch 1.2.0)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| RUN-1 | A self-hosted GitHub Actions runner on this Mac, in your home folder or `/Users/Shared`, or an `actions.runner.*` launch item. The Shai-Hulud 2.0 worm registered victims' Macs as runners in a hidden `~/.dev-env` folder. Watch reads the runner's name and the repository it serves, never its credentials. | **Act now** for a runner in a hidden folder, named `SHA1HULUD`, owned by root or started as a daemon ("A GitHub Actions runner on this Mac looks like a worm's backdoor"); Review for a runner whose owner none of your clones come from; FYI for the rest | Fix for Act now: stop it, quarantine its folder and rotate GitHub tokens. Otherwise the card links to the repository's runner settings: if you set it up, nothing to do. |

## Trust stores (TRUST)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| TRUST-1 | A root certificate that you, an app or an administrator added to the keychains' trust settings, so the Mac trusts it for every secure connection. Debugging proxies do this on purpose; adware and malware do it too. | Review; FYI when its name is a known debugging or local-development tool's own certificate authority (Cloak Proxy, mitmproxy, Charles, Proxyman, HTTP Toolkit, Fiddler, mkcert, Burp Suite, Caddy, Docker Desktop, Laravel Valet) | Watch never removes it. The fix: if you don't use it any more, delete it in Keychain Access. |

Distrusted certificate authorities in the other trust stores on the Mac (Homebrew's, each Python certifi, Node and Electron, JDKs) are found by a headline's [trust-store check](https://docs.subcloak.com/cloak-watch/check-my-mac/#trust-stores).

## Versions (VER)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| VER-1 | An installed copy of macOS, Safari, a browser, an editor, Docker Desktop, a runtime or a developer tool at a version with a flaw known to be exploited, from the feed's list built from Apple's actively exploited macOS and Safari flaws and CISA's Known Exploited Vulnerabilities catalog. One card per copy, such as "macOS 26.6.2 has an exploited flaw", naming the flaw and the release that fixes it. | Review | Only exploited flaws, only in installed apps and tools and the OS, never a library in a lockfile: Watch isn't a CVE scanner. See [versions](https://docs.subcloak.com/cloak-watch/check-my-mac/#versions-of-macos-apps-and-tools) for where each version is read. |

## Headline checks (CHK)

When a headline's own checks answer [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/) with **This Mac is affected** or **Relevant to you**, Watch opens one card for that headline. Its ID names the kind of check that found it. Package answers don't open CHK cards: the headline's incident packs raise [PKG-1](#pkg-1) and the others.

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| CHK-version | An app, tool or macOS version in the range a headline names. | Review | Each copy is judged on its own. |
| CHK-trustStore | A trust store on the Mac that still trusts a certificate authority a headline names, by its public key. | Review | Apple's roots count as fixed once Apple's revocation list on this Mac is newer than Apple's block. |
| CHK-serviceFootprint | A login, token or config file for a service a headline names. The card is titled **Relevant to you:** and lists ordered rotation steps. | FYI | Presence only: Watch can't see your account. |
| CHK-repoConfig | A workflow in a local clone with a headline's workflow file name, address, string or action. | Review | |
| CHK-hostFile | A file or folder at a path a headline names. | Review | Exact path only. |

Affected cards are titled **Affected:** and the headline's title, and list each place with its fix. When the headline's incident pack has already opened a card for the same files, Watch keeps only the pack's card.

## Homebrew (BREW)

(added in Cloak Watch 1.2.0)

Watch never runs `brew`: each fix is a command for you to run. See [Homebrew and Docker](https://docs.subcloak.com/cloak-watch/homebrew-and-docker/).

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| BREW-1 | Homebrew settings in a `brew.env` file or a shell profile that redirect downloads or turn off its checks ("Homebrew settings redirect downloads or turn off its checks"): `HOMEBREW_*_DOMAIN` or `*_GIT_REMOTE` overrides, `HOMEBREW_NO_VERIFY_ATTESTATIONS`, `HOMEBREW_NO_REQUIRE_TAP_TRUST`, `HOMEBREW_CURLRC` and similar. | Review | A company mirror shows here too: mark it as not a problem. |
| BREW-2 | A third-party tap whose Git remote isn't the repository its name says, or whose remote changed since Watch first saw it. | Review | |
| BREW-3 | A tap or formula an incident pack names. | From the pack | |
| BREW-4 | A cask app with no quarantine flag, so Gatekeeper never checked it, that is unsigned or ad-hoc signed ("… skipped Gatekeeper and isn't signed"). | Review | Fix: `brew reinstall --cask`, without `--no-quarantine`. |

## Docker (DOCK)

(added in Cloak Watch 1.2.0)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| DOCK-1 | A file in `~/.docker/cli-plugins` (or another Docker plugin folder) that isn't a link into Docker Desktop, OrbStack, Rancher Desktop, Podman or Homebrew and isn't signed by an identified developer ("Docker CLI plugin from an unknown source"). | Review | Docker's own plugin names, which Docker's docs have you install by hand, are never quarantined: the card asks you to compare the file's SHA-256 with the plugin's release page, or to reinstall Docker Desktop. Unknown plugins can be moved to Quarantine. |
| DOCK-2 | A registry password or token saved in `~/.docker/config.json` ("Docker registry passwords are saved in plain text"). | Review | Watch records which registries, never the password. |
| DOCK-3 | A remote registry in `insecure-registries`, or a Docker context, daemon host or `DOCKER_HOST` that uses plain `tcp://` to another machine ("Docker pulls from … without TLS", "Docker talks to … without TLS"). | Review | Local addresses are skipped. |

Container images an incident names are [PKG-10](#pkg-10).

## Running programs (PROC)

(added in Cloak Watch 1.2.0)

From [Watch mode](https://docs.subcloak.com/cloak-watch/watch-mode/), once a minute while **Check running programs** is on.

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| PROC-1 | A program running from a path a published incident names, such as `~/.helper` or `~/.config/sysmon`, or a script at one of those paths run by `python`, `node`, `sh` or another interpreter ("Running now: a program … uses"). | Act now | Only your own processes. When the same file also has a card, that card says "It's running now". |
| PROC-2 | An unsigned or ad-hoc-signed program running straight from a temporary folder or as a hidden file in your home folder ("Unsigned program running from …"). | Review | |

## Malware (MAL)

(added in Cloak Watch 1.2.0)

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| MAL-1 | A crypto-wallet app in `/Applications` or `~/Applications` (Ledger Live, Trezor Suite, Exodus, Electrum, Atomic Wallet, Coinomi, Guarda, Wasabi Wallet, Sparrow, Bitcoin Core, Keplr, Monero GUI) that isn't signed by its developer, was changed after it was signed, or whose developer changed since Watch first saw it. | Act now; Review for an app signed by a developer other than the one its maker publishes | Watch reads the app's `Info.plist` and signature, never the wallet's data. Fix: Watch moves the app to Quarantine; reinstall it from the vendor and move your funds from another device. |
| MAL-2 | Apple's XProtect: "macOS won't install XProtect updates by itself" when **Install Security Responses and system files** is off, or "XProtect's rules are N days old" when they're more than 60 days old. | Review when updates are off; FYI when the rules are old | Watch shows Apple's rules; it doesn't copy or use them. |

## Network (NET)

(added in Cloak Watch 1.2.0)

These need the optional [network extension](https://docs.subcloak.com/cloak-watch/ai-activity/network-extension/). Watch looks at which program opens each outgoing connection and where it goes, never what's sent. See [Network alerts](https://docs.subcloak.com/cloak-watch/network-alerts/).

| ID | What it looks for | Tier | False alarms |
|---|---|---|---|
| NET-1 | Any program connecting to a host or IP address an incident pack names ("… connected to …, named in an incident"). | Act now | Common hosts such as `github.com`, `registry.npmjs.org` and `pypi.org` are never treated as incident addresses. |
| NET-5 | Shapes 2025 and 2026 attacks on developers used: a program asking for cloud credentials at a cloud metadata address; an install script or editor sending data to a request catcher such as webhook.site, or talking to Telegram's bot API; an editor querying a Solana node; an unsigned program looking up the Mac's public IP address; an install script making 8 or more GitHub API calls in 15 seconds. | **Act now** for cloud metadata when an install script started it; Review for the rest, including an editor reaching cloud metadata (Azure and AWS editor extensions check it) | Solana checks skip editors with a web3 extension installed. Mark a card as not a problem to stop it coming back. |

## GitHub (GH)

(added in Cloak Watch 1.2.0)

Only when you connect [GitHub](https://docs.subcloak.com/cloak-watch/github/). Watch reads your repositories and account read-only and matches everything on this Mac.

| ID | What it looks for | Tier |
|---|---|---|
| GH-1 | A known-malicious package version pinned in a repository's lockfile on GitHub. | **Act now** when the repository has workflows that could have installed it; Review otherwise |
| GH-2 | Worm activity on your account: repositories named like s1ngularity's or Shai-Hulud's, a self-hosted runner named `SHA1HULUD`, or the worms' workflows ("… used your GitHub account"). | Act now |
| GH-3 | A private repository made public. | Review; **Act now** for three in a day, a name ending in `-migration`, or with other worm signs |
| GH-4 | A run of a workflow an incident names since the incident began ("A workflow from … ran in …"): treat it as a leak. | Act now |
| GH-5 | A workflow on GitHub that matches a headline's workflow check ("On GitHub: …"). | Review |
| GH-6 | A public repository that runs workflows on a self-hosted runner. | Review |
| GH-7 | Webhooks over `http`, without certificate checks or to a request-capture service; webhooks without a secret. | Review; FYI without a secret |
| GH-8 | Deploy keys that can push: added in the last 14 days, or older. | Review for recent ones; FYI otherwise |
| GH-9 | Outside collaborators who can push. | FYI |
| GH-10 | Unprotected default branches on public or shared repositories. | FYI |
| GH-11 | Actions settings that give workflows more than they need: a write token by default, workflows that approve pull requests, fork workflows without approval. | FYI |
| GH-12 | An SSH, signing or GPG key added to your account in the last 14 days that isn't on this Mac. | Review |

The same workflow rules as your local clones ([REPO-1 to REPO-7](#repositories-and-ci-repo) and [PKG-9](#pkg-9)) also run on GitHub's copies, titled "On GitHub: …".

## Domains (DOM)

(added in Cloak Watch 1.2.0)

Only for the [domains you add](https://docs.subcloak.com/cloak-watch/domains/).

| ID | What it looks for | Tier |
|---|---|---|
| DOM-1 | The certificate has expired or expires within 14 days; or it expires within 30 days. | Review; FYI within 30 days |
| DOM-2 | The certificate chain uses a certificate authority a headline distrusts ("Replace the certificate for …"). | Review |
| DOM-3 | macOS doesn't trust the certificate for the domain. | Review |
| DOM-4 | A CNAME points at a name that no longer exists, so someone could claim it (subdomain takeover). | Review |
| DOM-5 | No CAA record, so any certificate authority may issue for the domain. | FYI |
| DOM-6 | CAA records don't allow the certificate authority that issued the current certificate. | FYI |

When a local TLS-inspecting proxy, such as Cloak Proxy or a company proxy, answers for a domain, Watch says so and doesn't judge the certificate it saw.

## Under review

(added in Cloak Watch 1.2.0)

[Under review](https://docs.subcloak.com/cloak-watch/under-review/) cards come from Subcloak's release scanner, not from a check on your Mac: "Under review: unusual change in …", then "Reported to …" and, once a registry or public database confirms it, "Removed by …" at Act now. They have no check ID. The scanner is in a test period and doesn't send verdicts to Macs yet.

## Planned checks

These checks are planned and aren't in Cloak Watch 1.2.

| ID | Planned check |
|---|---|
| AGT-7 | An AI CLI started with `--dangerously-skip-permissions`, `--yolo` or `--trust-all-tools` by a package manager |
| MCP-4 | An MCP server the registry has taken down or flagged |
| NET-2 to NET-4 | Unsigned programs going online in general; AI traffic to unknown providers; secrets in prompts (Guard covers secrets in prompts today: see [Guard rules](https://docs.subcloak.com/cloak-watch/ai-activity/guard/)) |

## Related

  - [Home, Inbox and incidents](https://docs.subcloak.com/cloak-watch/inbox/): What an incident page shows.
  - [Inventory](https://docs.subcloak.com/cloak-watch/inventory/): Every place these checks look.
  - [Check my Mac](https://docs.subcloak.com/cloak-watch/check-my-mac/): How headline checks answer, and what they read.