The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/agent.py script uses the subprocess module to execute system utilities and security tools including unzip, otool, plutil, strings, security, frida, and objection. These executions use argument lists rather than shell strings, which effectively prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of well-known security frameworks including frida, frida-tools, and objection via pip. These are industry-standard tools for mobile security research.
[DATA_EXFILTRATION]: The skill is designed to identify and extract sensitive information from the iOS environment, including hardcoded API keys and credentials stored in the iOS Keychain. This functionality is the intended primary purpose for authorized security auditing.
[PROMPT_INJECTION]: The skill processes untrusted external data from iOS app bundles (IPA files), creating an indirect prompt injection surface. Ingestion points: Data is read from Info.plist and binary strings via scripts/agent.py. Boundary markers: The script does not utilize specific delimiters to isolate potentially malicious embedded instructions. Capability inventory: The script performs analysis and reports findings but does not autonomously act on extracted instructions. Sanitization: Extraction is performed using regular expressions and standard parsing libraries.

performing-ios-app-security-assessment