Can I see where a specific file came from using this skill?

Yes, you can search by application name or URL patterns to find the specific origin record associated with your downloads.

What is the macOS quarantine database?

It is a system-level SQLite database located at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 that tracks the source URL and timestamp of every file downloaded to your Mac.

Does clearing the history delete my actual files?

No, the quarantine_clear tool only removes the metadata records from the macOS log; it does not delete any physical files from your hard drive.

Is this skill useful for security audits?

Absolutely. It provides a weekly audit tool that summarizes all recent download activity, helping you spot unauthorized or unexpected file transfers.

macOS File Origin Auditor

Name: macOS File Origin Auditor
Author: nathanvale

bynathanvale

•

セキュリティとテスト

Analyzes the macOS quarantine database to track file download sources, audit security risks, and manage system download history.

概要

The Quarantine skill provides deep visibility into the origin of files on your macOS system by querying the hidden Gatekeeper-related SQLite database. It allows users to identify which applications downloaded specific files, verify source URLs, perform weekly security audits, and clear historical data for enhanced privacy. This is an essential utility for developers and power users who need to trace the provenance of software or perform routine security maintenance directly from Claude Code.

主な機能

Trace file origins and original download source URLs
1 GitHub stars
Search and filter quarantine records by date range or URL patterns
Securely clear macOS download history records for privacy management
Audit downloads by specific applications like Safari, Chrome, or Curl
Generate weekly security summaries to monitor system activity

ユースケース

Auditing application behavior to see which tools are downloading files
Performing a privacy cleanup by purging the system quarantine log
Investigating the source and origin of a suspicious file or installer

概要

主な機能

Trace file origins and original download source URLs
1 GitHub stars
Search and filter quarantine records by date range or URL patterns
Securely clear macOS download history records for privacy management
Audit downloads by specific applications like Safari, Chrome, or Curl
Generate weekly security summaries to monitor system activity

ユースケース

Auditing application behavior to see which tools are downloading files
Performing a privacy cleanup by purging the system quarantine log
Investigating the source and origin of a suspicious file or installer