Skip to main content
affpapa.org
RU EN
skill CX Codex GP ChatGPT official · OpenAI

signing-entitlements — Codex skill: what it does, how to install

Diagnoses macOS code signing, App Sandbox, and Gatekeeper failures. Useful when a binary or app bundle refuses to launch on macOS.

Install into Codex · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openai/plugins --skill signing-entitlements -a codex
Open on GitHub

What signing-entitlements does

The skill inspects macOS application bundles and binaries when execution fails due to trust policies rather than build errors. It locates the executable inside Contents/MacOS/, reads entitlements with codesign, and queries Gatekeeper via spctl.

Failures are classified into explicit categories like missing entitlements, ad-hoc signatures, or Hardened Runtime issues. The agent then supplies the shortest sequence of repair commands. It explicitly keeps local debug signing separate from distribution prerequisites.

macOS developers dealing with launch denials will benefit most from this setup.

What it helps with

  • diagnose Gatekeeper rejections and trust-policy failures
  • verify embedded entitlements and App Sandbox permissions
  • detect invalid signatures across nested application bundles
  • separate local debugging issues from notarization requirements

Example prompts for the agent

  • Inspect code signing and entitlements for MyApp.app
  • Why is Gatekeeper rejecting this binary in Contents/MacOS?
  • Classify the signing failure and give me the minimal fix commands

How to install signing-entitlements

1Skills CLI (Vercel)

npx skills add openai/plugins --skill signing-entitlements -a codex

2Manually: put the files in place

.agents/skills/signing-entitlements/SKILL.md

For all projects use ~/.agents/skills/

From the same set201

The whole set →
supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs remotion-render official Remotion Exports videos and static stills from Remotion projects using CLI commands. CX Codex GP ChatGPT 3installs figma-create-new-file official Figma Creates blank Figma, FigJam, or Slides files inside draft folders. It resolves planKey and editor types before invoking Figma MCP tools. CX Codex GP ChatGPT 6installs swiftui-performance-audit official OpenAI Pinpoints SwiftUI runtime issues like frame drops, unresponsive taps, and excessive view body computations. Works code-first and guides Instruments profiling. CX Codex GP ChatGPT 109installs swiftui-liquid-glass official OpenAI This skill helps build and review SwiftUI Liquid Glass interfaces for iOS 26+. Use it when adopting the API or checking fallbacks, interaction, and design fit. CX Codex GP ChatGPT 121installs swiftui-ui-patterns official OpenAI This skill helps build and refactor SwiftUI interfaces, from navigation and state to layouts and controls. Use it for new screens or changes to an existing project. CX Codex GP ChatGPT 114installs swiftui-view-refactor official OpenAI Refactors SwiftUI view files into clean, testable structures with dedicated subview types and proper Observation ownership. CX Codex GP ChatGPT 113installs ios-memgraph-leaks official OpenAI Captures and inspects iOS leaks from a simulator process or .memgraph. Useful for tracing retained objects and checking a fix with before-and-after evidence. CX Codex GP ChatGPT 1,054installs

Similar

verify-agent-action official github Audits proposed AI agent actions, deployments, and approvals before execution. It checks parameters, nonces, and telemetry, never authorizing or running actions on its own. GitHub Copilot 29installs tm7-threat-model official github Generates valid .tm7 threat model files for Microsoft Threat Modeling Tool v7.3+ using STRIDE. Useful when you need ready-to-open threat models directly from architecture descriptions. GitHub Copilot 29installs application-integration-troubleshooting official google Diagnoses failed, stuck, or silent Google Cloud Application Integration and Integration Connectors runs. Use it when HTTP 200 does not match the work completed. Claude Code Gemini CLI CX Codex 16installs agent-decision-receipts Alireza Rezvani Mints tamper-evident, post-quantum-signed receipts for agent actions like deploys or payments. Lets you verify autonomous decisions offline from the certificate alone. Claude Code 44installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. Claude Code CX Codex Cursor +1 52,200installs

Questions about signing-entitlements

How to install signing-entitlements in Codex?

Run npx skills add openai/plugins --skill signing-entitlements in your project root. It writes the configuration to .agents/skills/signing-entitlements/SKILL.md.

What does signing-entitlements do?

It inspects macOS binary signatures, validates property lists, and identifies reasons behind Gatekeeper launch rejections.

Which native tools does the skill invoke?

It relies directly on standard macOS utilities, specifically codesign, spctl, security, and plutil.

Source text

SKILL.md · MIT 
---
name: signing-entitlements
description: Inspect macOS signing, entitlements, and Gatekeeper issues. Use when diagnosing code signing, sandbox, hardened runtime, or trust failures.
---

# Signing & Entitlements

## Quick Start

Use this skill when the failure smells like codesigning rather than compilation:
launch refusal, missing entitlement, invalid signature, sandbox mismatch,
hardened runtime confusion, or trust-policy rejection.

## Workflow

1. Inspect the bundle or binary.
   - Locate the `.app` or executable.
   - Identify the main binary inside `Contents/MacOS/`.

2. Read signing details.
   - Use `codesign -dvvv --entitlements :- <path>`.
   - Use `spctl -a -vv <path>` when Gatekeeper behavior matters.
   - Use `plutil -p` for entitlements or Info.plist inspection.

3. Classify the failure.
   - Unsigned or ad hoc signed
   - Wrong identity
   - Entitlement mismatch
   - Hardened runtime issue
   - App Sandbox issue
   - Nested code signing issue
   - Distribution/notarization prerequisite issue

4. Explain the minimum fix path.
   - Say exactly what is wrong.
   - Show the shortest set of validation or repair commands.
   - Distinguish local development problems from distribution problems.

## Useful Commands

- `codesign -dvvv --entitlements :- <app-or-binary>`
- `spctl -a -vv <app-or-binary>`
- `security find-identity -p codesigning -v`
- `plutil -p <path-to-entitlements-or-plist>`

## Guardrails

- Never invent missing entitlements.
- Do not conflate notarization with local debug signing.
- If the real issue is a build setting or provisioning profile, say so directly.

## Output Expectations

Provide:
- what artifact was inspected
- what signing state it is in
- the exact failure class
- the minimum fix or validation sequence

© OpenAI · MIT · openai/plugins

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor