mac-mini-as-headless-server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mac-mini-as-headless-server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Configures macOS for unattended 24/7 server operation by disabling sleep, screen saver, and App Nap, while enabling Wake-on-LAN, auto-restart after power failure, and SSH remote login. The screen lock lives in the user keybag and changing it requires the user's account password (root alone can't), so the script verifies it, offers to turn it off when run interactively (you type the user's password once), and prints the exact CLI/GUI fix on unattended runs.
Requires `sudo`. Targets macOS 15 (Sequoia) and later. Target hardware: Mac Mini, Mac Studio, or any Mac used as a headless server.
Apple Silicon caveat: on an Apple Silicon Mac with no local keyboard/mouse, pmset displaysleep 0 is not enough. WindowServer still parks the physical display (DPMS off ~30s after each wake), which turns the panel black and makes RealVNC / screen-capture sessions show black, because they capture the physical display. The only reliable fix is to hold a PreventUserIdleDisplaySleep assertion continuously — this skill installs a caffeinate -d LaunchDaemon (step 7) for that.
displaysleep 0| Setting | Command | Effect |
|---|---|---|
| Screen saver off | defaults -currentHost write com.apple.screensaver idleTime -int 0 | Disables screen saver activation |
| System sleep off | pmset -c sleep 0 | Never sleep |
| Display sleep off | pmset -c displaysleep 0 | Never turn off display |
| Disk sleep off | pmset -c disksleep 0 | Never spin down disks |
| Dim before sleep off | pmset -c halfdim 0 | No pre-sleep dimming (absent/no-op on some modern Macs — not listed in their pmset -g custom) |
| Wake-on-LAN | pmset -c womp 1 | Wake on network access |
| Auto-restart | pmset -c autorestart 1 | Restart after power loss |
| App Nap off | defaults write NSGlobalDomain NSAppSleepDisabled -bool YES | Prevents app throttling |
| SSH on | systemsetup -setremotelogin on | Enables Remote Login — needs Full Disk Access; confirm with -getremotelogin |
| Keep display awake (Apple Silicon) | caffeinate -d via LaunchDaemon | Holds PreventUserIdleDisplaySleep — stops the headless display park that displaysleep 0 does not prevent (panel + VNC go black) |
| Screen lock status | sysadminctl -screenLock status | Reports lock state — no sudo needed |
| Screen lock off | sysadminctl -screenLock off -password - | Needs the user's account password (user keybag) — root/sudo alone can't change it. Scriptable form: -password 'pw'. Step 8 runs the interactive form for you on TTY runs |
Run the bundled script as root, via sudo from the target user's account (it refuses to run from a bare root shell so per-user defaults land in the right account):
sudo bash scripts/setup.shWhat it does, in order:
idleTime 0, per-userpmset -c sleep/displaysleep/disksleep/halfdim 0womp 1autorestart 1systemsetup -setremotelogin on; needs Full Disk Access and can fail while exiting 0, so trust the verify output, not this step/Library/LaunchDaemons/com.local.keepdisplayawake.plist running caffeinate -d (RunAtLoad + KeepAlive, survives reboots), loads it, then fires caffeinate -u -t 2 to wake an already-parked panel. Follows with a verification dump: pmset -g, daemon state (want a PID), display assertion (want caffeinate listed), and systemsetup -getremotelogin (want On)sysadminctl -screenLock status (no sudo needed). On an interactive (TTY) run it prompts once for the user's account password and turns the lock off in place; unattended runs get the manual GUI/CLI instructions insteadpmset and systemsetup require root; defaults commands must run as the real user via sudo -upmset defines -a (all), -b (battery), -c (charger), -u (UPS); the man page doesn't say which profile a flagless write targets, so be explicit — -c (or -a) on a desktopman systemsetup) and historically exits 0 even on failure, so a plain run can silently do nothing. Always confirm with systemsetup -getremotelogin (the script prints it in the verify block)caffeinate -d LaunchDaemon (step 7). Symptom: the physical panel and/or VNC session is black even though pmset -g shows displaysleep 0.-d only prevents sleep; it won't wake an already-parked panel. Fire a one-shot caffeinate -u -t 2 to wake it (step 7 does this after loading the daemon).sysadminctl -screenLock off -password 'pw' (or -password - to be prompted). Verify with sysadminctl -screenLock status — no sudo needed (step 8). For fleets, an MDM configuration profile with the com.apple.screensaver payload is the hands-off alternative.To restore display sleep later:
sudo pmset -c displaysleep 10 # 10 minutesTo remove the keep-display-awake LaunchDaemon (step 7):
sudo launchctl bootout system /Library/LaunchDaemons/com.local.keepdisplayawake.plist
sudo rm /Library/LaunchDaemons/com.local.keepdisplayawake.plistTo re-enable the screen lock (as the user, no sudo; prompts for the account password):
sysadminctl -screenLock immediate -password - # or a delay in seconds~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.