plist-drift-detector — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plist-drift-detector (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The existing launchd-drift-recovery watches 4 hard-coded labels. Audit on 2026-05-07 found 16 loaded-only and 12 source-only labels of drift across the broader fleet. Either class can hide a real bug (a service registered out-of-band; a service quietly removed from the loadout). This skill reconciles them and alerts only when the drift set changes — stable drift is logged but quiet.
bash skills/plist-drift-detector/run.sh # default — alert on change
bash skills/plist-drift-detector/run.sh --dry-run # no Telegram, no state writes
bash skills/plist-drift-detector/run.sh --baseline # write current drift as baseline (use after intentional changes)
bash skills/plist-drift-detector/run.sh --synthetic # synthetic test: artificially injects a missing plist into the comparisonai.openclaw.*, ai.hermes.*, ai.dailyaiagents.*, com.dailyai.*, com.dailyaiagents.*, com.dai.*).config/launchd/*.plist (excluding DEAD-* archived plists).loaded_only — running but no source-of-truth (suspicious — out-of-band installation)source_only — checked into source but not loaded (suspicious — should be running)data/plist-drift/state.json. Compare today's drift set hash to yesterday's.STATUS=GREEN — no drift STATUS=YELLOW drift=N hash=... — drift exists; same as last run; silent STATUS=ALERT drift=N changed_from=... — drift changed; Telegram sent
data/plist-drift/state.json:
{
"ts": "2026-05-07T17:41Z",
"loaded_only": ["..."],
"source_only": ["..."],
"hash": "sha256(loaded_only|source_only)",
"last_alert_ts": "2026-05-07T17:41Z"
}launchd-drift-recovery's job.launchctl list, basename, sort, comm.Use --synthetic to inject a fake com.dailyai.IMAGINARY into the source list and verify the alert path runs without sending Telegram (synthetic mode forces --dry-run semantics on outbound).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.