How do I see downloads from a specific site?

You can use the quarantine_search_url tool with a pattern like 'github.com' to filter all records originating from that specific domain.

What is the macOS quarantine database?

It is a local SQLite database (QuarantineEventsV2) maintained by macOS Gatekeeper that logs the source URL, timestamp, and application responsible for every file download.

Does this skill work on Windows or Linux?

No, this skill is specifically designed for macOS as it interacts with proprietary system files located in ~/Library/Preferences.

Can this skill clear my download history?

Yes, the quarantine_clear tool allows you to wipe these records, though it requires an explicit confirmation flag due to its destructive nature.

Is it safe to use for security audits?

Yes, it provides a read-only view of download events for investigation, making it a safe tool for forensic analysis of where files on your system originated.

macOS Quarantine Audit

Name: macOS Quarantine Audit
Author: nathanvale

bynathanvale

•

Security & Testing

Inspects the macOS quarantine database to track file download origins, audit security sources, and manage privacy history.

The Quarantine skill provides transparency into the macOS Gatekeeper security system by allowing users to query the local SQLite database that logs file download origins. It enables developers to identify which applications downloaded specific files, trace the original source URLs, and perform comprehensive security audits of recent activity. Ideal for those who need to investigate mysterious files or manage their digital privacy, this skill turns hidden system metadata into actionable insights directly within the Claude Code environment.

Key Features

01Identify the source and timestamp of any quarantined file

02Search download history by application name or URL pattern

034 GitHub stars

04Clear historical download records to maintain privacy

05Rank applications based on their total download volume

06Perform weekly security audits to summarize recent file downloads

Use Cases

01Investigating the origin of an unknown executable or zip file on a Mac

02Auditing weekly download activity to identify potentially malicious sources

03Cleaning up privacy-sensitive download metadata across the system

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add nathanvale/side-quest-marketplace-old quarantine

For use in Claude.ai and ChatGPT

Key Features

01Identify the source and timestamp of any quarantined file

02Search download history by application name or URL pattern

034 GitHub stars

04Clear historical download records to maintain privacy

05Rank applications based on their total download volume

06Perform weekly security audits to summarize recent file downloads

Use Cases

01Investigating the origin of an unknown executable or zip file on a Mac

02Auditing weekly download activity to identify potentially malicious sources

03Cleaning up privacy-sensitive download metadata across the system

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add nathanvale/side-quest-marketplace-old quarantine

For use in Claude.ai and ChatGPT