ios-pentesting-tricks
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference for authorized iOS penetration testing. It provides command-line examples for binary analysis tools (otool, plutil), filesystem inspection (sqlite3, grep), and runtime instrumentation frameworks (Frida, Objection). The methodologies described are standard practices in the mobile security industry.
- [PROMPT_INJECTION]: The skill contains templates for shell commands and runtime scripts where user-provided inputs, such as application bundle identifiers and domain names, are intended to be interpolated. This represents a potential surface for indirect prompt injection if an agent processes untrusted external data without validation. However, within the context of a technical playbook, this is a standard operational pattern rather than an active exploit.
- Ingestion points: Application bundle IDs used in
fridaandideviceinstallercommands; domain names used incurlrequests for AASA files. - Boundary markers: The skill does not provide explicit delimiters or "ignore embedded instructions" warnings for the interpolated data.
- Capability inventory: The skill instructs the agent to execute shell commands for binary analysis and data extraction, and to run JavaScript hooks within a mobile application's process.
- Sanitization: There is no evidence of input sanitization or validation for the user-supplied parameters.
Audit Metadata