How do I install the Mobile IOS Assessment skill?

Run npx skillmds@latest add noorqureshi/mobile-ios-assessment in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Mobile IOS Assessment safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Mobile IOS Assessment?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Mobile IOS Assessment free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Mobile IOS Assessment?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Mobile IOS Assessment by noorqureshi

Name: Mobile IOS Assessment
Author: NoorQureshi

Mobile IOS Assessment

Assess an iOS app (static + dynamic). Load when the target is an IPA / iOS app, an iOS bug-bounty scope, or "test the iOS app". Signals: .ipa, Info.plist, Swift/Obj-C, Keychain, URL schemes, ATS exceptions, Frida/objection on a jailbroken device.

NoorQureshi Updated Sep 17, 2026

File contents

iOS app assessment

When it applies

You have an IPA (or an app on a jailbroken test device) and scope covers the iOS client + its backend. As with Android, most impact is the backend reached through the app, plus local data / keychain leaks and insecure IPC (URL schemes, universal links).

Why it works

The app ships its logic and secrets, and trusts its own device. Decryption + class-dump reveal endpoints and Obj-C/Swift classes; the Keychain and app container often hold tokens; and runtime instrumentation removes jailbreak/pinning checks the server assumed held.

Method

Unpack & inspect: decrypt the app (from a jailbroken device / frida-ios-dump), then otool -L, class-dump, and read Info.plist for URL schemes, NSAppTransportSecurity (ATS) exceptions, permissions, and background modes. MobSF for an automated static pass.
Local storage: inspect the app container — NSUserDefaults, plists, sqlite, cached files — and the Keychain for tokens/PII stored insecurely (objection → ios keychain dump).
Dynamic: objection -g <bundle> explore — bypass jailbreak detection and SSL pinning (→ mobile-cert-pinning-bypass), hook methods, then proxy and test the backend (BOLA/mass-assignment).
IPC: URL schemes / universal links (→ mobile-deeplink-abuse), pasteboard leakage, app extensions.

Gotchas

Non-jailbroken testing is limited — you usually need a jailbroken device or a re-signed app.
ATS exceptions (NSAllowsArbitraryLoads) signal weakened TLS worth flagging.
The high-impact bugs are usually server-side reached via the app — proxy and test the API.

Verify success

Concrete impact: leaked working credential/endpoint, keychain/token exposure, unauthenticated IPC reach, or a backend bug proven through the app's traffic.

References

OWASP MASVS/MASTG (iOS); objection & frida-ios-dump; OWASP Mobile Top 10 (2024).

---name: mobile-ios-assessmentdescription: Assess an iOS app (static + dynamic). Load when the target is an IPA / iOS app, an iOS bug-bounty scope, or "test the iOS app". Signals: .ipa, Info.plist, Swift/Obj-C, Keychain, URL schemes, ATS exceptions, Frida/objection on a jailbroken device.---# iOS app assessment## When it appliesYou have an IPA (or an app on a jailbroken test device) and scope covers the iOS client + itsbackend. As with Android, most impact is the backend reached through the app, plus local data /keychain leaks and insecure IPC (URL schemes, universal links).## Why it worksThe app ships its logic and secrets, and trusts its own device. Decryption + class-dump revealendpoints and Obj-C/Swift classes; the Keychain and app container often hold tokens; and runtimeinstrumentation removes jailbreak/pinning checks the server assumed held.## Method1. **Unpack & inspect**: decrypt the app (from a jailbroken device / `frida-ios-dump`), then `otool -L`, `class-dump`, and read `Info.plist` for URL schemes, `NSAppTransportSecurity` (ATS) exceptions, permissions, and background modes. MobSF for an automated static pass.2. **Local storage**: inspect the app container — `NSUserDefaults`, plists, sqlite, cached files — and the **Keychain** for tokens/PII stored insecurely (`objection` → `ios keychain dump`).3. **Dynamic**: `objection -g <bundle> explore` — bypass jailbreak detection and SSL pinning (→ `mobile-cert-pinning-bypass`), hook methods, then proxy and test the backend (BOLA/mass-assignment).4. **IPC**: URL schemes / universal links (→ `mobile-deeplink-abuse`), pasteboard leakage, app extensions.## Gotchas- Non-jailbroken testing is limited — you usually need a jailbroken device or a re-signed app.- ATS exceptions (`NSAllowsArbitraryLoads`) signal weakened TLS worth flagging.- The high-impact bugs are usually server-side reached via the app — proxy and test the API.## Verify successConcrete impact: leaked working credential/endpoint, keychain/token exposure, unauthenticated IPCreach, or a backend bug proven through the app's traffic.## ReferencesOWASP MASVS/MASTG (iOS); objection & frida-ios-dump; OWASP Mobile Top 10 (2024).

Frequently asked questions