skills/mukul975/anthropic-cybersecurity-skills/analyzing-ios-app-security-with-objection/Gen Agent Trust Hub
analyzing-ios-app-security-with-objection
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The scripts scripts/agent.py and scripts/process.py utilize the subprocess.run function to invoke the objection and frida command-line utilities. This is the core mechanism for performing runtime analysis on target iOS apps.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources, specifically the output generated by Objection and Frida when inspecting target applications. This presents a surface for indirect prompt injection if a target app provides malicious data designed to be interpreted as instructions. 1. Ingestion points: Output from Objection commands captured in scripts/agent.py and scripts/process.py. 2. Boundary markers: None identified. 3. Capability inventory: Execution of Objection and Frida CLI tools via subprocess in scripts/agent.py and scripts/process.py. 4. Sanitization: Simple regex and string splitting are used to parse tool output in scripts/process.py.
- [DYNAMIC_EXECUTION]: The skill supports the execution of dynamic scripts. In scripts/agent.py, the run_frida function accepts script code that is executed directly in the target app process via the Frida CLI, which is a standard procedure for mobile security research.
Audit Metadata