ios-pentesting-skill

name	iOS-Pentesting-Skill
description	Comprehensive iOS app security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers decompilation, Info.plist analysis, URL schemes and universal links, secrets detection, crypto analysis, Frida/Objection integration, and IPA modification. Use when user says "audit IPA", "analyze iOS app", "iOS pentest", "app security", "decompile IPA", "iOS vulnerability assessment", "reverse engineer iOS", "modify IPA", "URL scheme abuse", "bypass SSL pinning", "bypass jailbreak detection", "download IPA from App Store", or provides an IPA for security review, decompiled iOS sources, or decoded resources. Do NOT use for Android apps (use Android-specific skill), web application testing, or general programming help.
license	Apache-2.0
compatibility	macOS 11+ with Apple Silicon recommended (full functionality). Linux has ~90% compatibility with tool alternatives (see tool-installation-ios.md). Some features require jailbroken iOS device. Requires Frida, Objection, dsdump, and standard macOS toolchain (plutil, otool, codesign, security, lipo).
allowed-tools	Bash(frida:*) Bash(objection:*) Bash(dsdump:*) Bash(class-dump:*) Bash(codesign:*) Bash(security:*) Bash(lipo:*) Bash(nm:*) Bash(strings:*) Bash(otool:*) Bash(jtool2:*) Bash(plutil:*) Bash(python3:*) Bash(ipa:*) Bash(unzip:*) Bash(zip:*) Bash(find:*) Bash(file:*) Bash(rg:*) Bash(xcrun:*) Bash(ideviceinstaller:*) Bash(idevicesyslog:*) Bash(ideviceinfo:*) Bash(idevicepair:*) Bash(ideviceimagemounter:*) Bash(afcclient:*) Bash(idevicecrashreport:*) Bash(ideviceprovision:*) Bash(swift-demangle:*) Bash(log:*) Bash(ipatool:*) Bash(plistutil:*) Bash(llvm-objdump:*) Bash(llvm-lipo:*) Bash(ldid:*) Read Write Edit Glob Grep
metadata	{"author":"DragonJAR SAS","version":"1.0.0","category":"mobile-security","tags":["ios","ipa-audit","static-analysis","dynamic-analysis","frida","objection","security-pentest","cvss-scoring","reverse-engineering","ipatool"]}

iOS App Security Audit

Overview

Language Rule (CRITICAL): Match the user's language in your responses.

• If user speaks Spanish → reply in Spanish
• If user speaks English → reply in English
• If user speaks another language → reply in that language
• Default to English only when the user's language is unclear

This rule applies to ALL interactions: questions, explanations, findings, everything.

Deterministic 6-phase static analysis + optional dynamic confirmation workflow. Remove noise early, keep the bundle scope tight. Only report vulnerabilities where source, propagation, and sink are understood or clearly marked as needing dynamic confirmation.

When to Use

• User provides an IPA file for security review
• User asks to analyze decompiled iOS source code
• User needs to modify or repackage an IPA for testing
• User wants iOS mobile security testing or vulnerability assessment
• User needs help testing URL schemes, universal links, or IPC mechanisms
• User mentions iOS reverse engineering or app analysis
• User wants to acquire an IPA from the App Store (via ipatool — see references/ipa-extraction-guide.md §5)

New to iOS pentesting? Start with references/getting-started-ios.md for a 15-minute quick start guide. Stuck on an issue? See references/troubleshooting-ios.md for centralized troubleshooting. Quick workflow reference? See references/ios-pentesting-decision-tree.md for a visual decision tree of the complete testing workflow with environment options (jailbroken device, iOS Simulator, non-jailbreak).

Critical Rules

1. NEVER report bare grep hits without traced context
2. ALWAYS constrain searches to the app namespace (avoid framework noise)
3. STOP and report immediately if decoding fails
4. ALWAYS use imperative language in findings
5. NEVER skip validation — if unsure, mark as "Needs Dynamic Confirmation"
6. ALWAYS provide concrete PoC (frida script, objection command, or URL scheme payload)
7. NEVER duplicate findings for the same root cause