# shortcuts

> List, run, and sign Shortcuts automation workflows from the command line.

shortcuts is the command-line interface to the Shortcuts app introduced in macOS Monterey. It can list the current user's shortcuts, run a shortcut by name or identifier with file input and output, and sign shortcut files for sharing. Shortcuts can contain scripting actions such as "Run Shell Script", "Run AppleScript", and "Run JavaScript for Automation", as well as actions that read files and send data to remote URLs. An attacker can use the shortcuts binary to proxy execution of these actions through an Apple-signed process, enumerate a user's existing automations, and prepare signed shortcut files for delivery to victims. Scripting actions only run when "Allow Running Scripts" is enabled in the Shortcuts Advanced settings.

- Page: https://loobins.io/binaries/shortcuts/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2026-11-07
- Tactics: Resource Development, Initial Access, Execution, Stealth, Discovery, Collection, Exfiltration

## Paths

- `/usr/bin/shortcuts`

## Example Use Cases

### Enumerate a user's shortcuts

List the shortcuts and folders in the current user's Shortcuts library, including their identifiers. Existing shortcuts can reveal automations that interact with sensitive apps, files, or services, and identify shortcuts that can be modified or run for proxy execution.

```bash
shortcuts list --show-identifiers
shortcuts list --folders
```

- Tactics: Discovery
- Tags: oneliner, bash

### Proxy execution of a shortcut that contains a scripting action

Run a shortcut that contains a "Run Shell Script", "Run AppleScript", or "Run JavaScript for Automation" action. The script runs as a child of the Shortcuts infrastructure rather than as a direct child of the attacker's shell, which can break simple parent-child process detection logic.

```bash
shortcuts run "Update Helper"
```

- Tactics: Execution, Stealth
- Tags: oneliner, bash, osascript

### Pass a file to a shortcut for collection or exfiltration

The --input-path option passes one or more files to a shortcut and --output-path writes its result to disk. A shortcut that uses the "Get Contents of URL" action can upload the supplied file to an attacker-controlled server.

```bash
shortcuts run "Backup" --input-path ~/Library/Keychains/login.keychain-db --output-path /tmp/result.txt
```

- Tactics: Collection, Exfiltration
- Tags: oneliner, file-transfer, network

### Sign a malicious shortcut for distribution

Sign a shortcut file so that anyone can import it. Signed shortcuts can be delivered through phishing or downloads and imported by a victim with open, after which they can be run with shortcuts run.

```bash
shortcuts sign --mode anyone --input malicious.shortcut --output signed.shortcut
open signed.shortcut
```

- Tactics: Resource Development, Initial Access
- Tags: bash

## Detections

- Process execution detection: shortcuts run invoked by a script interpreter, an unsigned process, or a process launched from a download or temporary directory
- Process execution detection: shells or script interpreters (sh, bash, zsh, osascript, python3) spawned by the Shortcuts infrastructure (WorkflowKit / BackgroundShortcutRunner)
- Command-line detection: shortcuts sign with --mode anyone, or shortcuts run with --input-path referencing credential stores such as ~/Library/Keychains, ~/.ssh, or browser profile directories

## Resources

- [Run shortcuts from the command line - Apple Support](https://support.apple.com/guide/shortcuts-mac/run-shortcuts-from-the-command-line-apd455c82f02/mac)
- [Advanced Privacy and security settings in Shortcuts on Mac - Apple Support](https://support.apple.com/guide/shortcuts-mac/apdfeb05586f/mac)
- [shortcuts man page - SS64](https://ss64.com/mac/shortcuts.html)