performing-ios-app-security-assessment

SUSPICIOUS/HIGH-RISK but not malware. The skill is internally consistent with its stated purpose as an iOS pentesting guide, and its main tools come from expected official sources. However, it gives an AI agent offensive security capabilities including SSL pinning bypass, jailbreak-detection bypass, app patching, and sensitive data extraction, which materially increases misuse risk; the referenced local bypass script is also unverifiable from the skill text.

The fragment appears to be a legitimate iOS security assessment tool, not malware. No clear data exfiltration, persistence, command injection, credential theft from host environments, or destructive behavior is present. The main security concern is ZIP path traversal through unvalidated extractall on untrusted IPA files. Dynamic keychain dumping is sensitive but aligned with the stated auditing purpose and requires authorization. The supplied code is also syntactically incomplete and would not run as shown.