Can I see where a specific file came from using this skill?

Yes, you can search by application name or URL patterns to find the specific origin record associated with your downloads.

What is the macOS quarantine database?

It is a system-level SQLite database located at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 that tracks the source URL and timestamp of every file downloaded to your Mac.

Does clearing the history delete my actual files?

No, the quarantine_clear tool only removes the metadata records from the macOS log; it does not delete any physical files from your hard drive.

Is this skill useful for security audits?

Absolutely. It provides a weekly audit tool that summarizes all recent download activity, helping you spot unauthorized or unexpected file transfers.

macOS File Origin Auditor

Name: macOS File Origin Auditor
Author: nathanvale

bynathanvale

•

Security & Testing

Analyzes the macOS quarantine database to track file download sources, audit security risks, and manage system download history.

About

The Quarantine skill provides deep visibility into the origin of files on your macOS system by querying the hidden Gatekeeper-related SQLite database. It allows users to identify which applications downloaded specific files, verify source URLs, perform weekly security audits, and clear historical data for enhanced privacy. This is an essential utility for developers and power users who need to trace the provenance of software or perform routine security maintenance directly from Claude Code.

Key Features

Trace file origins and original download source URLs
1 GitHub stars
Search and filter quarantine records by date range or URL patterns
Securely clear macOS download history records for privacy management
Audit downloads by specific applications like Safari, Chrome, or Curl
Generate weekly security summaries to monitor system activity

Use Cases

Auditing application behavior to see which tools are downloading files
Performing a privacy cleanup by purging the system quarantine log
Investigating the source and origin of a suspicious file or installer

About

Key Features

Trace file origins and original download source URLs
1 GitHub stars
Search and filter quarantine records by date range or URL patterns
Securely clear macOS download history records for privacy management
Audit downloads by specific applications like Safari, Chrome, or Curl
Generate weekly security summaries to monitor system activity

Use Cases

Auditing application behavior to see which tools are downloading files
Performing a privacy cleanup by purging the system quarantine log
Investigating the source and origin of a suspicious file or installer