Signing Entitlements
- 25 installs
- 4.9k repo stars
- Updated July 14, 2026
- openai/plugins
signing-entitlements diagnoses macOS codesign, entitlements, and Gatekeeper failures.
About
The signing-entitlements skill diagnoses macOS failures that smell like codesigning rather than compilation: launch refusal, missing entitlements, invalid signatures, sandbox mismatches, hardened runtime confusion, or trust-policy rejection. It locates the .app or executable, reads signing with codesign -dvvv --entitlements and spctl -a -vv for Gatekeeper, and inspects plists with plutil -p. Failures are classified as unsigned, wrong identity, entitlement mismatch, hardened runtime, App Sandbox, nested signing, or distribution prerequisite issues. The minimum fix path quotes exact problems and shortest validation commands, distinguishing local development from distribution problems. Useful commands include security find-identity for signing identities. Guardrails forbid inventing entitlements and avoid conflating notarization with debug signing.
- Inspects bundle signing with codesign and spctl.
- Classifies Gatekeeper and entitlement failure modes.
- Provides minimum fix and validation command sequences.
- Distinguishes local debug from distribution signing issues.
- Never invents missing entitlements without evidence.
Signing Entitlements by the numbers
- 25 all-time installs (skills.sh)
- +2 installs in the week ending Jul 26, 2026 (Skillselion tracking)
- Ranked #1,549 of 2,202 Security skills by installs in the Skillselion catalog
- Data as of Aug 4, 2026 (Skillselion catalog sync)
signing-entitlements capabilities & compatibility
- Capabilities
- signing inspection commands · failure classification taxonomy · minimum fix path guidance
- Use cases
- security audit · debugging
- Platforms
- macOS
What signing-entitlements says it does
Inspect macOS signing, entitlements, and Gatekeeper issues
Never invent missing entitlements
npx skills add https://github.com/openai/plugins --skill signing-entitlementsAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 25 |
|---|---|
| repo stars | ★ 4.9k |
| Last updated | July 14, 2026 |
| Repository | openai/plugins ↗ |
Why does my macOS app fail codesign or Gatekeeper checks?
Inspect macOS signing, entitlements, and Gatekeeper issues for codesign and sandbox failures.
Who is it for?
macOS developers hitting launch refusal or entitlement errors.
Skip if: Skip when failures are clearly compiler or linker errors.
When should I use this skill?
Diagnosing code signing, sandbox, hardened runtime, or trust failures.
What you get
Identified failure class with minimum fix commands.
Files
Signing & Entitlements
Quick Start
Use this skill when the failure smells like codesigning rather than compilation: launch refusal, missing entitlement, invalid signature, sandbox mismatch, hardened runtime confusion, or trust-policy rejection.
Workflow
1. Inspect the bundle or binary.
- Locate the
.appor executable. - Identify the main binary inside
Contents/MacOS/.
2. Read signing details.
- Use
codesign -dvvv --entitlements :- <path>. - Use
spctl -a -vv <path>when Gatekeeper behavior matters. - Use
plutil -pfor entitlements or Info.plist inspection.
3. Classify the failure.
- Unsigned or ad hoc signed
- Wrong identity
- Entitlement mismatch
- Hardened runtime issue
- App Sandbox issue
- Nested code signing issue
- Distribution/notarization prerequisite issue
4. Explain the minimum fix path.
- Say exactly what is wrong.
- Show the shortest set of validation or repair commands.
- Distinguish local development problems from distribution problems.
Useful Commands
codesign -dvvv --entitlements :- <app-or-binary>spctl -a -vv <app-or-binary>security find-identity -p codesigning -vplutil -p <path-to-entitlements-or-plist>
Guardrails
- Never invent missing entitlements.
- Do not conflate notarization with local debug signing.
- If the real issue is a build setting or provisioning profile, say so directly.
Output Expectations
Provide:
- what artifact was inspected
- what signing state it is in
- the exact failure class
- the minimum fix or validation sequence
interface:
display_name: "Signing & Entitlements"
short_description: "Inspect codesign, entitlements, and Gatekeeper failures"
default_prompt: "Use $signing-entitlements to inspect a macOS app or binary, classify the signing or entitlement problem, and explain the minimum fix path."
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does signing-entitlements do?
signing-entitlements diagnoses macOS codesign, entitlements, and Gatekeeper failures.
When should I use signing-entitlements?
Diagnosing code signing, sandbox, hardened runtime, or trust failures.
Is this skill safe to install?
Review the Security Audits panel on this page before installing in production.