Mobile iOS Whitebox Audit
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.
Best use case
Mobile iOS Whitebox Audit is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.
Teams using Mobile iOS Whitebox Audit should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/mobile-ios/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How Mobile iOS Whitebox Audit Compares
| Feature / Agent | Mobile iOS Whitebox Audit | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Use this skill when the user is auditing an iOS application — directory contains `.ipa`, `Info.plist`, `*.swift`, `*.m`, `*.mm`, or an `xcodeproj`. Also activates when the conversation mentions WKWebView, NSURLSession, Keychain, App Transport Security, or any `com.apple.*` / `bundleidentifier`-style iOS package name.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Mobile iOS Whitebox Audit ## When this skill applies The user is reviewing an iOS target. Signals to look for: - The target directory has an `Info.plist`, `*.swift`, `*.m`, `*.mm`, or `*.xcodeproj`. - The conversation mentions WKWebView, NSURLSession, Keychain, ATS, KeychainAccess, ObjC runtime. - A previous run produced `.claude/findings.json` entries whose `type` starts with `ios-*`. ## Triage anchors | Type | What to verify | |---|---| | `ios-ats-arbitrary-loads` | The Info.plist has `NSAllowsArbitraryLoads=true`. Confirm whether any specific exempt domain is actually needed; otherwise this disables ATS for the entire app. | | `ios-ats-partial-exemption` | `NSAllowsLocalNetworking` / `NSAllowsArbitraryLoadsForMedia` widens trust. Inventory which hosts the app actually needs over HTTP. | | `ios-keychain-accessible-always` | `kSecAttrAccessibleAlways` / `kSecAttrAccessibleAlwaysThisDeviceOnly` lets locked-device attackers read the item. Switch to `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` or `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`. | | `ios-trust-all-ssl` | `URLSessionDelegate.urlSession(_:didReceive:completionHandler:)` returns `.useCredential, URLCredential(trust: serverTrust)` without `SecTrustEvaluate`. Catastrophic — replace with explicit pinning. | | `ios-uiwebview-deprecated` | UIWebView is deprecated since iOS 12 and has known issues. Migrate to WKWebView. | | `ios-webview-html-concat` | `loadHTMLString` receives an interpolated/concatenated string. If any value originates from a network response or pasteboard, it renders attacker HTML/JS in the app origin. | | `ios-webview-evaljs-concat` | `evaluateJavaScript` builds the JS payload via Swift interpolation. Any escape from a string literal executes attacker JS in the WebView. | ## Workflow: prefer `/vuln-scout:mobile-audit` For iOS targets that include both source and bundle resources, point `/vuln-scout:mobile-audit` at the project root. The driver discovers `*/Info.plist` and Swift/ObjC sources under `src/`, `Sources/`, or `Application/`. If you have an extracted IPA, point the driver at the unzipped Payload folder. The Info.plist will be at `Payload/AppName.app/Info.plist`. ## Cross-platform parallels Many of the high-signal Android detectors have an iOS analog. When you see a chain on Android, consider whether the iOS app has the same one: | Android | iOS analog | |---|---| | `mobile-webview-js-injection` | `ios-webview-evaljs-concat` | | `mobile-nsc-narrow-pinning` | `ios-ats-partial-exemption`, `ios-trust-all-ssl` | | `mobile-shared-prefs-sensitive` | `ios-keychain-accessible-always`, NSUserDefaults misuse | | `mobile-insecure-tls` | `ios-trust-all-ssl` | See also [[mobile-android]] for the Android counterpart.
Related Skills
start-audit
Guided first-run security audit: doctor, scope, threats, scan, verify, report.
Mobile Payment Tokenization Patterns
Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen, Google Pay, Apple Pay, FirstData-style iframe encryptors). The skill catalogues the high-signal attack patterns vuln-scout detects in mobile payment flows — server-controlled tokenization URLs, JavaScript-injection-into-WebView card-data exfiltration, JS-bridge token construction, and payment scope mismatches — and maps each to the detector that fires.
Workspace Discovery
This skill should be used when the user asks to "detect workspaces", "find packages", "list monorepo packages", "workspace structure", "monorepo analysis", or needs to identify workspace/package boundaries in a codebase for focused security analysis.
vulnerability-chains
This skill should be used when the user asks about "vulnerability chains", "chained exploits", "multi-step attacks", "SSRF to RCE", "pivot attacks", or needs to identify how vulnerabilities in different components can be combined during whitebox security review.
Vulnerability Patterns
This skill should be used when the user asks about "vulnerability patterns", "how to find SQL injection", "XSS patterns", "command injection techniques", "OWASP vulnerabilities", "common web vulnerabilities", "exploitation patterns", or needs to understand how specific vulnerability classes work during whitebox security review.
Threat Modeling
This skill should be used when the user asks about "threat model", "STRIDE", "data flow diagram", "attack surface", "threat analysis", "security architecture", "component threats", "trust boundaries", "technology decomposition", or needs systematic threat identification during whitebox security review.
verify-finding
Drive a single finding through CPG verification and false-positive triage.
scope-repo
Decide audit boundaries for large or monorepo targets and write audit-plan.md.
review-pr
Diff-aware PR security review with verified findings and PR comment payload.
package-evidence
Bundle findings, reports, audit plan, and ledger into one evidence zip.
Sensitive Data Leakage
Detect ANY credential/secret flowing to ANY output sink. Use when asked about "credential leakage", "secret logging", "sensitive data exposure", "CWE-532", "password in logs", "token exposure", or security logging issues.
Security Misconfiguration
This skill should be used when the user asks about "security misconfiguration", "default credentials", "debug mode", "security headers", "exposed endpoints", "TLS configuration", or needs to find configuration-related vulnerabilities during whitebox security review.