🐾 Feral Audit

Comprehensive macOS security audit for AI agent infrastructure.

Your Mac runs AI agents, manages API keys, and serves as the control plane for powerful tools. But how secure is it, really?

Feral Audit tells you — with a letter grade.

  ╔═══════════════════════════════════════════╗
  ║          🐾  FERAL AUDIT  v0.1.0          ║
  ║     Comprehensive macOS Security Audit    ║
  ║            by Feral Labs                  ║
  ╚═══════════════════════════════════════════╝

  ✅ OpenClaw Configuration: B
  ✅ macOS Hardening: A-
  ✅ Network Security: A
  ✅ Dependency Security: A-
  ✅ Credentials Hygiene: C+

  ══════════════════════════════════════════════
    OVERALL GRADE: B+
  ══════════════════════════════════════════════
    ✗ 1 failure  ⚠ 5 warnings  ✓ 18 passed  (38 total checks)

Quick Start

# Install
curl -fsSL https://raw.githubusercontent.com/siraustin/feral-audit/main/install.sh | bash

# Run
feral-audit

Or clone and run directly:

git clone https://github.com/siraustin/feral-audit.git
cd feral-audit
./feral-audit

What It Checks

1. OpenClaw Configuration

Goes beyond openclaw audit — checks auth token strength, hook security (sessionKey overrides, IP allowlists), browser control auth, SSRF protections, and state directory permissions.

2. macOS Hardening

• FileVault disk encryption
• System Integrity Protection (SIP)
• Application Firewall & stealth mode
• Gatekeeper (app notarization)
• Automatic security updates
• Screen lock settings
• Remote access services (SSH, Screen Sharing, ARD)
• AirDrop discoverability

3. Network Security

• Open port scan — what's listening and where
• Tailscale VPN status & peer count
• Services exposed outside the tunnel
• SSH key audit: age, permissions, key type strength
• WiFi security protocol

4. Dependency Security

• npm audit on OpenClaw installation
• Outdated Homebrew packages (flags security-critical ones)
• Python package vulnerability check
• Node.js and Python version currency

5. Credentials Hygiene

• World-readable credential files (.env, .aws/credentials, .npmrc, etc.)
• Secrets in environment variables vs. Keychain
• Shell history secret leaks
• Git credential storage method
• .env file permissions

Output Formats

# Terminal (default) — colored report with grades
feral-audit

# JSON — machine-readable for fleet aggregation
feral-audit --json

# HTML — dark-themed report for sharing
feral-audit --html -o audit-report.html

# Single category
feral-audit --category macos

# Deep checks (may prompt for sudo)
feral-audit --elevated

# Disable sensitive value redaction (private use only)
feral-audit --no-redact

Grading

Each category gets a letter grade (A+ through F) based on findings:

Grade	Meaning
A+	Excellent — no issues found
A/A-	Strong — minor informational findings only
B+/B/B-	Good — some warnings worth addressing
C+/C/C-	Fair — notable security gaps
D	Poor — significant vulnerabilities
F	Critical — immediate action required

The overall grade is a weighted average — OpenClaw config, network, and credentials are weighted higher than dependency freshness.

Requirements

• macOS 13+ (Ventura or later, optimized for macOS 15 Sequoia)
• Python 3.9+ (ships with macOS or Xcode CLT)
• Apple Silicon or Intel (tested on M2 Ultra, M4)
• No sudo required for basic audit
• No external Python packages — stdlib only

Philosophy

The free audit is the top of the funnel.

You ran our audit. You got a C. Now you know exactly what's wrong — and we can fix everything it found.

Feral Audit is designed to be:

• Honest — no scare tactics, no inflated scores
• Actionable — every finding includes context and recommendations
• Safe to share — sensitive values are auto-redacted by default
• Fast — full audit completes in under 30 seconds
• Portable — pure Python, no pip installs, works on any Mac

Roadmap

• Phase 1 — CLI tool with 5 audit categories
• Phase 2 — Remediation commands (feral-audit fix)
• Phase 3 — Fleet dashboard (aggregate JSON reports)
• Phase 4 — Continuous monitoring mode
• Phase 5 — Public web service at feralbots.com/audit

Project Structure

feral-audit/
├── feral-audit          # Main CLI entry point
├── install.sh           # Quick installer
├── lib/
│   ├── auditors/
│   │   ├── base.py          # Base auditor class
│   │   ├── openclaw_audit.py
│   │   ├── macos_audit.py
│   │   ├── network_audit.py
│   │   ├── dependency_audit.py
│   │   └── credentials_audit.py
│   ├── grading.py       # Letter grade calculation
│   └── report.py        # Terminal/JSON/HTML output
└── tests/

License

MIT — use it, share it, audit everything.

---

🐾 A Feral Labs product.