Is the Happy App Audit skill free?

Yes. The skill itself is free from iamzhihuix/happy-claude-skills. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Happy App Audit SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.

How do I install Happy App Audit?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Happy App Audit with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Happy App Audit

Static macOS .app telemetry auditor: fingerprints embedded SDKs, endpoints, on-disk data

by iamzhihuix · iamzhihuix/happy-claude-skills

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.8/10
Tested: Jul 31, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 8fe573b

Cloned the repo (bun 1.3.14 present, macOS) and ran scripts/run.ts end-to-end against /Applications/Kimi.app and /Applications/Discord.app with --out to a temp dir. It produced meta.json, bucketed strings/*.{urls,domains,sql,events}.md, matched.md, local_data.md and a 138-line report.md; for Kimi it enumerated 4 embedded frameworks with sizes, bucketed 1382 URLs from the Electron Framework binary, and dumped Cache.db's SQLite .schema without reading rows. Baseline (my own ad-hoc plutil/otool/strings|grep, 25 lines): otool -L surfaced only Electron Framework + libSystem and `strings MacOS/Kimi | grep` returned zero domains because the launcher is thin — the skill found the real telemetry surface the baseline missed. Fingerprint matching returned 0 confirmed for both (honest negative — the DB targets native ByteDance/Tencent IME bundles, not Electron/JS-asar apps), and lib/shell.ts enforces a read-only command whitelist; no curl|sh, base64, eval, or hardcoded machine paths found.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 7/10
Docs & honesty 5/5

What Happy App Audit does

Statically audits an installed macOS .app bundle to report what telemetry it collects, which upload endpoints it maps to, and what it leaves on disk, using read-only tools only (strings, otool, plutil, codesign, sqlite3 .schema) with no network requests or debugger attach. Fingerprints embedded SDKs (ByteDance AppLog/Parfait/TTNet, Tencent mars/MMKV/Bugly, Sentry, Firebase, Umeng, etc.), buckets extracted strings into urls/domains/sql/events, and renders a markdown report. Triggers when the user asks to audit, investigate, or reverse-engineer a macOS app for telemetry, data upload, privacy, or SDK detection against paths like /Applications or /Library/Input Methods.

How to install Happy App Audit

git clone --depth 1 https://github.com/iamzhihuix/happy-claude-skills.git /tmp/happy-app-audit-src
mkdir -p ~/.claude/skills
cp -R /tmp/happy-app-audit-src/skills/happy-app-audit ~/.claude/skills/happy-app-audit
# Requires bun in PATH (falls back to `npx -y bun`). macOS only (uses otool/codesign/plutil).
# Run a full audit (writes report + audit trail):
#   bun ~/.claude/skills/happy-app-audit/scripts/run.ts /Applications/Foo.app --out ~/app-audit
# Optional --card renders a 4:5 share image and needs the separate baoyu-imagine skill;
# without it the skill still writes card_prompt.md and prints an install hint.

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Happy App Audit

/happy-app-audit Static macOS .app telemetry auditor: fingerprints embedded SDKs, endpoints, on-disk data

It also activates on plain-language prompts like these:

Audit this app for hidden telemetry SDKs
Find what data this macOS app uploads
Reverse-engineer this app's tracking endpoints

Frequently asked questions

Is the Happy App Audit skill free?: Yes. The skill itself is free from iamzhihuix/happy-claude-skills. SkillProof publishes the install command and an independent test verdict at no cost.
Does Happy App Audit work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 31, 2026. Verdict: Tested · Works. Cloned the repo (bun 1.3.14 present, macOS) and ran scripts/run.ts end-to-end against /Applications/Kimi.app and /Applications/Discord.app with --out to a temp dir. It produced meta.json, bucketed strings/*.{urls,domains,sql,events}.md, matched.md, local_data.md and a 138-line report.md; for Kimi it enumerated 4 embedded frameworks with sizes, bucketed 1382 URLs from the Electron Framework binary, and dumped Cache.db's SQLite .schema without reading rows. Baseline (my own ad-hoc plutil/otool/strings|grep, 25 lines): otool -L surfaced only Electron Framework + libSystem and `strings MacOS/Kimi | grep` returned zero domains because the launcher is thin — the skill found the real telemetry surface the baseline missed. Fingerprint matching returned 0 confirmed for both (honest negative — the DB targets native ByteDance/Tencent IME bundles, not Electron/JS-asar apps), and lib/shell.ts enforces a read-only command whitelist; no curl|sh, base64, eval, or hardcoded machine paths found.
What is the Happy App Audit SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.
How do I install Happy App Audit?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Happy App Audit with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.