ios-reverse-engineering

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches binary toolkits from recognized external repositories to enable analysis functions.
  • Downloads the ipsw toolkit from official GitHub releases (blacktop/ipsw).
  • Downloads the jtool2 Mach-O analyzer from the author's official domain (newosxbook.com).
  • [PRIVILEGE_ESCALATION]: The setup script utilizes elevated permissions to configure the environment.
  • scripts/install-dep.sh uses sudo to install required dependencies through system package managers such as apt, dnf, or pacman when accessible.
  • [COMMAND_EXECUTION]: Orchestrates various shell commands and specialized binary analysis frameworks.
  • Executes complex shell scripts and coordinates the use of radare2, rizin, and Ghidra headless to perform deep inspection of iOS binaries and libraries.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted application bundles provided for analysis.
  • Ingestion points: extract-ipa.sh ingests and extracts content from untrusted .ipa files and .app bundles.
  • Boundary markers: None explicitly implemented within the skill scripts; the system relies on the isolation provided by the analysis tools.
  • Capability inventory: The skill has the capability to execute subprocesses, write files to the local system for reporting, and invoke system-level utilities.
  • Sanitization: Standard utilities like unzip and grep are employed; however, the parsing of malformed or malicious binary structures by third-party reversing tools represents an inherent risk surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 06:33 AM