Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add terrylica/cc-skills --skill persistence-auditgit clone --depth 1 https://github.com/terrylica/cc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/terrylica/cc-skills/persistence-audit)<a href="https://agentmods.dev/skills/terrylica/cc-skills/persistence-audit"><img src="https://agentmods.dev/badge/skills/terrylica/cc-skills/persistence-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/terrylica/cc-skills/persistence-audit"><img src="https://agentmods.dev/badge/skills/terrylica/cc-skills/persistence-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00171 | $0.01274 |
| Opus 5.5 | $0.00068 | $0.00510 |
| Sonnet 5.5 | $0.00034 | $0.00255 |
| Haiku 4.5 | $0.00017 | $0.00127 |
Grade A, and why
persistence-audit scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo bash "$SKILL/persistence-inventory.sh" # adds root-only sections Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Tools that "find orphaned files" infer from whether a file maps to a known `.app`. On a machine with hand-written launchd runners in `~/.local/bin`, `~/.claude/tools` or a project `libexec`, that inference is catastrophi Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
persistence-audit — enumerate what persists, don't grep for it
Self-Evolving skill — if a macOS release adds or moves a persistence mechanism, add a section and record it here.
SKILL="$(cc-plugin-root macos-permissions)/skills/persistence-audit"
bash "$SKILL/persistence-inventory.sh" # everything readable as you
sudo bash "$SKILL/persistence-inventory.sh" # adds root-only sections
Read-only. It deletes nothing.
🔴 Why enumerate instead of search
Grepping for product names answers "is X here?" and can never answer "what is here?". In a real cleanup that searched for a handful of vendor names, a root LaunchDaemon was running the entire time and was missed — nobody typed its name. The same run also checked for /Applications/<Vendor>.app when the bundle was actually named <Vendor> Helper.app — a confident false negative.
Checking for a name you guessed at is not a test. List what exists, then classify.
🔴 launchd addresses jobs by the Label INSIDE the plist, never the filename
A vendor plist named com.vendor.vendor_service.plist can carry Label com.vendor.service. So:
launchctl bootout system/com.vendor.vendor_service # ESRCH -> "not loaded"
…looks like the job is already gone, and you then delete a root binary out from under a live KeepAlive job. Always:
label="$(/usr/libexec/PlistBuddy -c 'Print :Label' "$plist")"
[ -n "$label" ] || { echo "no Label key — refusing to guess a target"; exit 1; }
launchctl bootout "system/$label"
Section 1 of the inventory flags every LABEL!=FILENAME mismatch for you.
Mechanisms people forget
| Mechanism | Why it hides |
|---|---|
Audio HAL plug-ins (/Library/Audio/Plug-Ins/HAL) |
load into coreaudiod; appear in no launchd listing |
SecurityAgentPlugins + system.login.console |
wired into the authorization chain, not a process list |
Background Task Management (sfltool dumpbtm) |
the modern login-item registry; not a plist you can ls |
launchctl print-disabled |
remembers labels of long-uninstalled software forever |
| System extensions / DriverKit | systemextensionsctl list, separate from launchd |
Privileged helpers (/Library/PrivilegedHelperTools) |
installed by SMJobBless, survive app deletion |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago First seen · 82 lines · 171 tokens per session scan A 386937b9ea86
persistence-audit is a skill published in the GitHub repository terrylica/cc-skills (0 stars, last pushed today), licensed MIT. It adds 171 tokens to every session and 1,274 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.
Other skills, from other repositories
example-feature-generator
Generate boilerplate for new features following project conventions. Use when user says "create feature", "add feature", or "new feature scaffolding".
Vizra ADK Memory System
Implement persistent memory, session context, and vector memory (RAG) for AI agents.
thinking-theory-of-constraints
When throughput or latency is pipeline-limited, identify the single binding constraint and exploit, subordinate, elevate, then recheck—ignore non-constraints.
authentication-patterns
OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns.
agent-flutter-developer
Specialist subagent: Flutter/Dart cross-platform development, Riverpod state management, and platform channels specialist. Use when building Flutter apps, implementing state management, or working with native platform features. Trigger phrases: Flutter, Dart, Riverpod, Bloc, widget, MaterialApp, GoRouter, platform…
content-repurposer
Adapt content across platforms with tone/format shifting — blog to social, long to short, text to visual outline. Use when repurposing content for different channels, audiences, or formats.