Not in the top 1,000 by GitHub stars
incogbyte/iOS-reverse-engineering-claude-skill
Claude Code skill that enables Claude to extract, analyze, reverse engineer iOS apps
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/ios-reverse-engineering/SKILL.md
Week of Nov 2, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → ced35231baa4
No earlier version was observed for comparison.
118GitHub stars
3stars in 7 days
1skill in this repository
0commits in 30 days
Heat
2.8- Star growth, last 7 daysNot available
- Star growth, last 24 hoursNot available
- Rank movement, last 7 daysNot available
- Commits, last 30 daysNot available
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekNot available
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
30-day change not yet available: not enough history.
Individual skills in this repository
- ios-reverse-engineering
skills/ios-reverse-engineering
How it works
ios-reverse-engineering
When your agent uses it
Extract and analyze iOS IPA, .app bundles, Mach-O binaries, .dylib, and .framework files using ipsw, otool, strings, radare2/rizin, and Ghidra headless. Reverse engineer iOS apps, extract HTTP API endpoints (URLSession, Alamofire, Moya, AFNetworking, GraphQL, WebSocket), trace call flows from ViewControllers to network layer, analyze security patterns (ATS, cert pinning, keychain, jailbreak detection), audit static iOS vulnerabilities (insecure local storage, WebView/JS-bridge, deeplink/URL-scheme hijack, weak crypto/RNG, biometric-bypass patterns, sensitive-data logging, ATS detail, privacy/tracking, entitlements risk, debug artifacts), deep-scan for cloud & SaaS credentials (Firebase, AWS, GCP, Azure, Stripe, GitHub, GitLab, Twilio, SendGrid, Slack, Telegram, web3) with false-positive minimization (placeholder allowlist, format/entropy validation, client-safe tagging), perform LLM-assisted binary reversing analysis with Ghidra scripts, fingerprint embedded third-party SDKs with CVE checking, and detect anti-tampering protections (obfuscation, anti-debug, dylib injection prevention, integrity checks). Use when the user wants to extract, analyze, or reverse engineer iOS packages, find API endpoints, follow call flows, audit app security or vulnerabilities, scan for leaked secrets, identify third-party SDKs, detect app protections, or perform deep binary analysis.
What it loads into context
Frontmatter
325 tokensAlways available to the agent
SKILL.md
9,024 tokensWhen the skill is activated
Reference documents
28,989 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Prerequisites
- Workflow
- Output
- References
Scripts executed separately
scripts/audit-vulnerabilities.shscripts/check-deps.shscripts/deep-secret-scan.shscripts/detect-protections.shscripts/detect-sdks.shscripts/extract-ipa.shscripts/find-api-calls.shscripts/install-dep.shscripts/lib/plist.shscripts/reversing-analyze.sh
Files
SKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesSKILL.mdcore37,423 bytesreferences/anti-tampering-patterns.mddoc9,443 bytesreferences/api-extraction-patterns.mddoc12,550 bytesreferences/call-flow-analysis.mddoc10,400 bytesreferences/class-dump-usage.mddoc6,925 bytesreferences/cloud-secrets-patterns.mddoc15,252 bytesreferences/reversing-tools-guide.mddoc8,228 bytesreferences/sdk-fingerprinting.mddoc6,607 bytesreferences/setup-guide.mddoc7,363 bytesreferences/vulnerability-patterns.mddoc28,929 bytesscripts/audit-vulnerabilities.shruns42,445 bytesscripts/check-deps.shruns6,495 bytesscripts/deep-secret-scan.shruns28,889 bytesscripts/detect-protections.shruns29,236 bytesscripts/detect-sdks.shruns20,844 bytesscripts/extract-ipa.shruns22,125 bytesscripts/find-api-calls.shruns12,931 bytesscripts/ghidra/DecompileAllFunctions.javaasset6,386 bytesscripts/ghidra/ExportAPICalls.javaasset10,953 bytesscripts/ghidra/ExportCryptoUsage.javaasset8,599 bytesscripts/ghidra/ExportStringXrefs.javaasset7,840 bytesscripts/ghidra/FindSecrets.javaasset15,402 bytesscripts/install-dep.shruns14,049 bytesscripts/lib/plist.shruns3,558 bytesscripts/reversing-analyze.shruns20,244 bytes
Read SKILL.md
# iOS Reverse Engineering
Extract and analyze iOS IPA files, .app bundles, Mach-O binaries, dynamic libraries, and frameworks using ipsw (blacktop/ipsw), otool, strings, radare2/rizin, and Ghidra headless. Trace call flows through application code, analyze security patterns, deep-scan for cloud provider credentials (Firebase, GCP, AWS, Azure), perform LLM-assisted binary reversing with decompilation and Ghidra headless scripts, fingerprint embedded third-party SDKs with version detection and CVE cross-referencing, and detect anti-tampering protections (obfuscation tools, anti-debugging, dylib injection prevention, integrity checks, jailbreak detection). Produce structured documentation of extracted APIs and security findings. Works with both Swift and Objective-C applications.
## Prerequisites
This skill requires **ipsw** (which includes class-dump functionality and much more) and, on macOS, the standard developer tools (**otool**, **strings**, **plutil**, **codesign**) via Xcode Command Line Tools. For deep binary analysis, **radare2** (or **rizin**) is recommended; **Ghidra headless** is optional for advanced decompilation. **On Linux**, `ipsw` provides cross-platform Mach-O analysis, entitlements, class-dump and thinning; `libplist`/`plistutil` (or `python3` plistlib) provide plist parsing; `binutils` provides `strings`/`nm`. `otool`/`codesign`/`plutil`/`PlistBuddy`/`lipo` are macOS-only and the scripts fall back to `ipsw`/`plistutil`/`python3` automatically — no macOS tools required on Linux. Run the dependency checker to verify:
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/scripts/check-deps.sh
```
If anything is missing, follow the installation instructions in `${CLAUDE_PLUGIN_ROOT}/skills/ios-reverse-engineering/references/setup-guide.md`.
Skills included
- ios-reverse-engineering
Repository facts
- License
- Unlicense
- Created
- Mar 28, 2026
- Last pushed
- Jul 1, 2026
- Forks
- 23
- Open issues
- 0
- Project activity
- Slowing
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 5, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 21 notes
skills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/ios-reverse-engineering/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 32 dangerous shell commandsin 5 files: ios-reverse-engineering/scripts/install-dep.sh:8 ios-reverse-engineering/scripts/extract-ipa.sh:209 ios-reverse-engineering/references/setup-guide.md:39 and 2 more
- 108 network referencesin 12 files: ios-reverse-engineering/scripts/install-dep.sh:122 ios-reverse-engineering/references/cloud-secrets-patterns.md:41 ios-reverse-engineering/references/setup-guide.md:39 and 9 more
- No hidden or obfuscated text
- No instruction overrides
- 10 executable scriptsin 10 files: ios-reverse-engineering/scripts/audit-vulnerabilities.sh:1 ios-reverse-engineering/scripts/check-deps.sh:1 ios-reverse-engineering/scripts/deep-secret-scan.sh:1 and 7 more
- 71 references to secretsin 16 files: ios-reverse-engineering/scripts/audit-vulnerabilities.sh:182 ios-reverse-engineering/references/vulnerability-patterns.md:35 ios-reverse-engineering/references/cloud-secrets-patterns.md:13 and 13 more
- No requests to vote in Hot
Show all 221 signals by file
skills/ios-reverse-engineering/SKILL.md
- Access to secretsline 3
[Credential-related source omitted] - Access to secretsline 92
[Credential-related source omitted] - Network accessline 197
- **Source**: `MyApp.APIService` (class-dump header or strings reference) - **Base URL**: `https://api.example.com/v1` - Network accessline 198
- **Base URL**: `https://api.example.com/v1` - Access to secretsline 225
[Credential-related source omitted] - Access to secretsline 383
[Credential-related source omitted] - Access to secretsline 542
[Credential-related source omitted]
skills/ios-reverse-engineering/references/api-extraction-patterns.md
- Network accessline 34
var request = URLRequest(url: URL(string: "https://api.example.com/users")!) - Network accessline 77
AF.request("https://api.example.com/users/\(id)", - Network accessline 105
AFHTTPSessionManager *manager = [[AFHTTPSessionManager alloc] initWithBaseURL:[NSURL URLWithString:@"https://api.example.com"]]; - Network accessline 141
var baseURL: URL { URL(string: "https://api.example.com/v1")! } - Network accessline 222
# Operations grep -rn '\.fetch(query:\|\.perform(mutation:\|\.subscribe(subscription:' output/ - Network accessline 223
grep -rn '\.fetch(query:\|\.perform(mutation:\|\.subscribe(subscription:' output/ - Access to secretsline 350
[Credential-related source omitted] - Access to secretsline 353
[Credential-related source omitted] - Access to secretsline 356
[Credential-related source omitted] - Access to secretsline 362
[Credential-related source omitted] - Access to secretsline 363
[Credential-related source omitted] - Network accessline 380
- **Source**: `MyApp.APIService` (class-dump header or strings reference) - **Base URL**: `https://api.example.com/v1` - Network accessline 381
- **Base URL**: `https://api.example.com/v1` - Network accessline 382
- **Full URL**: `https://api.example.com/v1/path/to/endpoint`
skills/ios-reverse-engineering/references/call-flow-analysis.md
skills/ios-reverse-engineering/references/class-dump-usage.md
skills/ios-reverse-engineering/references/cloud-secrets-patterns.md
- Access to secretsline 13
[Credential-related source omitted] - Access to secretsline 32
[Credential-related source omitted] - Network accessline 41
When analyzing Firebase credentials, the LLM should: 1. Check if `API_KEY` has domain/app restrictions (cannot be determined from binary alone — flag for manual testing) 2. Verify if `DATABASE_URL` is accessible without authentication (`cur - Network accessline 42
[Credential-related source omitted] - Access to secretsline 42
[Credential-related source omitted] - Network accessline 43
2. Verify if `DATABASE_URL` is accessible without authentication (`curl <url>/.json`) - Network accessline 141
# Azure App Configuration grep -rni 'Endpoint=https://.*\.azconfig\.io' output/ - Network accessline 142
grep -rni 'Endpoint=https://.*\.azconfig\.io' output/ - Network accessline 206
grep -rni 'sentry\.io\|SentrySDK\|dsn.*sentry\|https://[a-f0-9]\{32\}@[a-z0-9]*\.ingest\.sentry\.io' output/ - Access to secretsline 212
[Credential-related source omitted] - Network accessline 245
# Web3 grep -rniE 'https://[a-z0-9]*\.infura\.io/v3/[A-Za-z0-9]{32}|https://[a-z-]*\.g\.alchemy\.com/[a-z0-9]+/[A-Za-z0-9_-]{30,}|BEGIN (RSA |OPENSSH |EC |PGP )?PRIVATE KEY|(0x)?[0-9a-fA-F]{64}' output/ - Network accessline 246
grep -rniE 'https://[a-z0-9]*\.infura\.io/v3/[A-Za-z0-9]{32}|https://[a-z-]*\.g\.alchemy\.com/[a-z0-9]+/[A-Za-z0-9_-]{30,}|BEGIN (RSA |OPENSSH |EC |PGP )?PRIVATE KEY|(0x)?[0-9a-fA-F]{64}' output/ - Access to secretsline 267
[Credential-related source omitted] - Access to secretsline 368
[Credential-related source omitted] - Network accessline 375
- GCP API Key → test with Maps/Geocoding API - Azure Connection String → test blob storage access - Stripe Secret Key → `curl https://api.stripe.com/v1/charges -u sk_live_xxx:` - Network accessline 377
- Stripe Secret Key → `curl https://api.stripe.com/v1/charges -u sk_live_xxx:`
skills/ios-reverse-engineering/references/reversing-tools-guide.md
- Network accessline 65
# Cross-references to a string r2 -q -c 'aaa; / https://api.; axtj @@ hit*' binary > string_xrefs.json - Network accessline 66
r2 -q -c 'aaa; / https://api.; axtj @@ hit*' binary > string_xrefs.json - Network accessline 128
# Or download from https://ghidra-sre.org/ - Access to secretsline 213
[Credential-related source omitted] - Access to secretsline 248
[Credential-related source omitted] - Access to secretsline 271
[Credential-related source omitted]
skills/ios-reverse-engineering/references/sdk-fingerprinting.md
- Access to secretsline 127
[Credential-related source omitted]
skills/ios-reverse-engineering/references/setup-guide.md
- Dangerous shell operationline 39
sudo apt-get install binutils libplist-utils - Network accessline 39
sudo apt-get install binutils libplist-utils # ipsw from GitHub releases (see the ipsw section below) curl -LO https://github.com/blacktop/ipsw/releases/latest/download/ipsw_Linux_x86_64.tar.gz - Network accessline 40
# ipsw from GitHub releases (see the ipsw section below) curl -LO https://github.com/blacktop/ipsw/releases/latest/download/ipsw_Linux_x86_64.tar.gz tar xzf ipsw_Linux_x86_64.tar.gz && mv ipsw ~/.local/bin/ - Network accessline 41
curl -LO https://github.com/blacktop/ipsw/releases/latest/download/ipsw_Linux_x86_64.tar.gz - Dangerous shell operationline 45
sudo pacman -S binutils libplist - Dangerous shell operationline 47
sudo dnf install binutils libplist - Network accessline 70
Download the latest release for your platform from: https://github.com/blacktop/ipsw/releases - Network accessline 71
https://github.com/blacktop/ipsw/releases - Network accessline 74
# macOS arm64 example curl -LO https://github.com/blacktop/ipsw/releases/latest/download/ipsw_macOS_arm64.tar.gz - Network accessline 75
curl -LO https://github.com/blacktop/ipsw/releases/latest/download/ipsw_macOS_arm64.tar.gz - Network accessline 108
# Download from the official source curl -o jtool2.tgz http://www.newosxbook.com/tools/jtool2.tgz - Network accessline 109
curl -o jtool2.tgz http://www.newosxbook.com/tools/jtool2.tgz - Dangerous shell operationline 178
sudo apt install libimobiledevice-utils ideviceinstaller - Dangerous shell operationline 181
sudo dnf install libimobiledevice-utils - Network accessline 256
1. Download from https://ghidra-sre.org/
skills/ios-reverse-engineering/references/vulnerability-patterns.md
- Access to secretsline 35
[Credential-related source omitted] - Access to secretsline 42
[Credential-related source omitted] - Access to secretsline 44
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Access to secretsline 70
[Credential-related source omitted] - Access to secretsline 78
[Credential-related source omitted] - Access to secretsline 83
[Credential-related source omitted] - Access to secretsline 87
[Credential-related source omitted] - Access to secretsline 160
[Credential-related source omitted] - Access to secretsline 172
[Credential-related source omitted] - Access to secretsline 273
[Credential-related source omitted] - Access to secretsline 282
[Credential-related source omitted] - Network accessline 309
# Cleartext endpoints / insecure websockets grep -rn '"http://[^"]+"' output/ - Network accessline 310
grep -rn '"http://[^"]+"' output/ - Network accessline 339
- Enforce `NSMinimumTLSVersion = TLSv1.2` (or `TLSv1.3`); keep forward secrecy. - Never disable cert validation. If pinning, pin to public keys and fail closed. - Use `https://`/`wss://` everywhere; remove leftover `http://`/`ws://` endpoin - Network accessline 340
- Never disable cert validation. If pinning, pin to public keys and fail closed. - Use `https://`/`wss://` everywhere; remove leftover `http://`/`ws://` endpoints. - If using AFNetworking/TrustKit/Alamofire pinning, keep `allowInvalidCertif - Network accessline 341
- Use `https://`/`wss://` everywhere; remove leftover `http://`/`ws://` endpoints. - Access to secretsline 344
[Credential-related source omitted] - Network accessline 348
- Info.plist-derived ATS findings are HIGH-confidence (low FP). - A `http://` string may be a documentation link or fallback; confirm it's used for traffic. - Network accessline 349
- A `http://` string may be a documentation link or fallback; confirm it's used for traffic. - Access to secretsline 403
[Credential-related source omitted] - Access to secretsline 411
[Credential-related source omitted] - Network accessline 419
# Debug-gated insecure behavior grep -rniE '#if\s*DEBUG|isDebug|debugMode' output/ | grep -iE 'staging|http://|\.test|\.internal|localhost|admin|backdoor|skipVerification' - Network accessline 420
grep -rniE '#if\s*DEBUG|isDebug|debugMode' output/ | grep -iE 'staging|http://|\.test|\.internal|localhost|admin|backdoor|skipVerification'
skills/ios-reverse-engineering/scripts/audit-vulnerabilities.sh
- Executable scriptline 1
#!/usr/bin/env bash - Access to secretsline 182
[Credential-related source omitted] - Access to secretsline 183
[Credential-related source omitted] - Access to secretsline 184
[Credential-related source omitted] - Access to secretsline 187
[Credential-related source omitted] - Access to secretsline 188
[Credential-related source omitted] - Access to secretsline 227
[Credential-related source omitted] - Access to secretsline 228
[Credential-related source omitted] - Access to secretsline 237
[Credential-related source omitted] - Access to secretsline 301
[Credential-related source omitted] - Access to secretsline 376
[Credential-related source omitted] - Access to secretsline 380
[Credential-related source omitted] - Network accessline 421
res=$(match '"http://[^"]+"') - Access to secretsline 446
[Credential-related source omitted] - Access to secretsline 447
[Credential-related source omitted] - Access to secretsline 579
[Credential-related source omitted] - Access to secretsline 580
[Credential-related source omitted] - Access to secretsline 581
[Credential-related source omitted] - Network accessline 602
res=$(proximity -i '#if\s*DEBUG|isDebug|debugMode' 'staging|http://|\.test|\.internal|localhost|admin|backdoor|skipVerification')
skills/ios-reverse-engineering/scripts/check-deps.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/ios-reverse-engineering/scripts/deep-secret-scan.sh
- Executable scriptline 1
#!/usr/bin/env bash - Dangerous shell operationline 207
trap 'rm -f "$SEEN_FILE"' EXIT - Network accessline 420
indicator "Azure" "Endpoints" '\.azurewebsites\.net|\.blob\.core\.windows\.net|\.table\.core\.windows\.net|\.vault\.azure\.net|\.database\.windows\.net|\.servicebus\.windows\.net' indicator "Azure" "Notification Hubs" 'SBNotificationHub|n - Network accessline 421
indicator "Azure" "Notification Hubs" 'SBNotificationHub|notificationhubname|DefaultFullSharedAccessSignature' "-i" indicator "Azure" "App Configuration" 'Endpoint=https://.*\.azconfig\.io' indicator "Azure" "Key Vault" 'keyvault|\.vaul - Network accessline 422
indicator "Azure" "App Configuration" 'Endpoint=https://.*\.azconfig\.io' - Network accessline 464
scan_secret "Sentry" "DSN (with secret)" "high" "no" 'https://[a-f0-9]{32}@[a-z0-9.-]+\.ingest\.sentry\.io/[0-9]+' - Network accessline 465
indicator "Sentry" "DSN/SDK (no embedded secret)" 'sentry\.io|SentrySDK|https://[a-f0-9]*@.*\.ingest\.sentry\.io' - Access to secretsline 469
[Credential-related source omitted] - Network accessline 495
scan_secret "Infura" "API Key (in URL)" "high" "yes" 'https://[a-z0-9]*\.infura\.io/v3/[A-Za-z0-9]{32}' - Network accessline 496
scan_secret "Alchemy" "API Key (in URL)" "high" "yes" 'https://[a-z-]*\.g\.alchemy\.com/[a-z0-9]+/[A-Za-z0-9_-]{30,}'
skills/ios-reverse-engineering/scripts/detect-protections.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/ios-reverse-engineering/scripts/detect-sdks.sh
skills/ios-reverse-engineering/scripts/extract-ipa.sh
- Executable scriptline 1
#!/usr/bin/env bash - Access to secretsline 205
[Credential-related source omitted] - Dangerous shell operationline 209
rm -f "$dest/entitlements.plist" - Dangerous shell operationline 224
rm -f "$dest/entitlements.plist" - Dangerous shell operationline 276
rm -f "$dest/class-dump/errors.log" - Access to secretsline 317
[Credential-related source omitted] - Dangerous shell operationline 410
rm -f "$dest/objc-info.txt" - Dangerous shell operationline 421
[[ -s "$dest/load-commands.txt" ]] && echo " Load commands saved to load-commands.txt" || rm -f "$dest/load-commands.txt" - Dangerous shell operationline 427
rm -f "$dest/objc-info.txt" - Dangerous shell operationline 432
[[ -s "$dest/macho-flags.txt" ]] || rm -f "$dest/macho-flags.txt" - Dangerous shell operationline 457
rm -f "$dest/symbols.txt" - Dangerous shell operationline 520
rm -rf "$IPA_EXTRACT_DIR" - Dangerous shell operationline 531
rm -rf "$IPA_EXTRACT_DIR" - Dangerous shell operationline 583
rm -rf "$IPA_EXTRACT_DIR"
skills/ios-reverse-engineering/scripts/find-api-calls.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 164
if [[ "$SEARCH_ALL" == true || "$SEARCH_URLS" == true ]]; then section "Hardcoded URLs (http:// and https://)" - Network accessline 165
section "Hardcoded URLs (http:// and https://)" - Access to secretsline 177
[Credential-related source omitted] - Access to secretsline 178
[Credential-related source omitted] - Access to secretsline 217
[Credential-related source omitted]
skills/ios-reverse-engineering/scripts/ghidra/DecompileAllFunctions.java
- Access to secretsline 23
[Credential-related source omitted]
skills/ios-reverse-engineering/scripts/ghidra/ExportCryptoUsage.java
- Access to secretsline 40
[Credential-related source omitted]
skills/ios-reverse-engineering/scripts/ghidra/ExportStringXrefs.java
- Access to secretsline 26
[Credential-related source omitted]
skills/ios-reverse-engineering/scripts/ghidra/FindSecrets.java
- Network accessline 71
[Credential-related source omitted] - Network accessline 72
[Credential-related source omitted] - Network accessline 73
[Credential-related source omitted] - Network accessline 80
[Credential-related source omitted] - Network accessline 81
[Credential-related source omitted] - Network accessline 82
[Credential-related source omitted] - Network accessline 83
[Credential-related source omitted] - Network accessline 84
[Credential-related source omitted] - Network accessline 85
[Credential-related source omitted]
skills/ios-reverse-engineering/scripts/install-dep.sh
- Executable scriptline 1
#!/usr/bin/env bash - Dangerous shell operationline 8
# 2 — requires manual action (e.g. sudo needed but not available) - Dangerous shell operationline 31
- Uses sudo if available and needed - Dangerous shell operationline 65
# Check sudo availability - Dangerous shell operationline 66
if command -v sudo &>/dev/null; then - Dangerous shell operationline 67
if sudo -n true 2>/dev/null; then - Dangerous shell operationline 94
sudo apt-get update -qq && sudo apt-get install -y -qq "$pkg" - Dangerous shell operationline 96
manual "Run: sudo apt-get install $pkg" - Dangerous shell operationline 102
sudo dnf install -y "$pkg" - Dangerous shell operationline 104
manual "Run: sudo dnf install $pkg" - Dangerous shell operationline 110
sudo pacman -S --noconfirm "$pkg" - Dangerous shell operationline 112
manual "Run: sudo pacman -S $pkg" - Network accessline 122
download() { local url="$1" dest="$2" if command -v curl &>/dev/null; then - Network accessline 123
local url="$1" dest="$2" if command -v curl &>/dev/null; then curl -fsSL -o "$dest" "$url" - Network accessline 124
if command -v curl &>/dev/null; then - Network accessline 125
curl -fsSL -o "$dest" "$url" - Network accessline 126
elif command -v wget &>/dev/null; then - Network accessline 127
wget -q -O "$dest" "$url" - Network accessline 128
else fail "Neither curl nor wget available." return 1 - Network accessline 129
fail "Neither curl nor wget available." - Network accessline 135
gh_latest_tag() { local repo="$1" local url="https://api.github.com/repos/$repo/releases/latest" - Network accessline 136
local repo="$1" local url="https://api.github.com/repos/$repo/releases/latest" if command -v curl &>/dev/null; then - Network accessline 137
local url="https://api.github.com/repos/$repo/releases/latest" if command -v curl &>/dev/null; then curl -fsSL "$url" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name":[[:space:]]*"\([^"]*\)".*/\1/' - Network accessline 138
if command -v curl &>/dev/null; then - Network accessline 139
curl -fsSL "$url" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name":[[:space:]]*"\([^"]*\)".*/\1/' - Network accessline 140
elif command -v wget &>/dev/null; then - Network accessline 141
wget -q -O - "$url" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name":[[:space:]]*"\([^"]*\)".*/\1/' - Network accessline 193
if [[ -z "$tag" ]]; then manual "Install ipsw via: brew install blacktop/tap/ipsw\nOr download from https://github.com/blacktop/ipsw/releases" - Network accessline 194
manual "Install ipsw via: brew install blacktop/tap/ipsw\nOr download from https://github.com/blacktop/ipsw/releases" - Network accessline 213
local filename="ipsw_${tag#v}_${platform}_${arch_suffix}" local url="https://github.com/blacktop/ipsw/releases/download/${tag}/${filename}.tar.gz" - Network accessline 214
local url="https://github.com/blacktop/ipsw/releases/download/${tag}/${filename}.tar.gz" - Dangerous shell operationline 221
rm -f "$tmp_file" - Dangerous shell operationline 231
rm -f "$tmp_file" - Network accessline 233
manual "Install ipsw via: brew install blacktop/tap/ipsw\nOr download from https://github.com/blacktop/ipsw/releases" - Network accessline 294
if [[ "$OS" == "macos" ]]; then info "jtool2 must be downloaded manually from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 295
info "jtool2 must be downloaded manually from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 300
info "Downloading jtool2..." if download "http://www.newosxbook.com/tools/jtool2.tgz" "$tmp_file"; then - Network accessline 301
if download "http://www.newosxbook.com/tools/jtool2.tgz" "$tmp_file"; then - Dangerous shell operationline 304
rm -f "$tmp_file" - Network accessline 312
ok "jtool2 installed to $install_dir" else manual "Download jtool2 from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 313
else manual "Download jtool2 from http://www.newosxbook.com/tools/jtool2.tgz" fi - Network accessline 314
manual "Download jtool2 from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 315
fi else manual "jtool2 is primarily a macOS tool. Download from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 316
else manual "jtool2 is primarily a macOS tool. Download from http://www.newosxbook.com/tools/jtool2.tgz" fi - Network accessline 317
manual "jtool2 is primarily a macOS tool. Download from http://www.newosxbook.com/tools/jtool2.tgz" - Network accessline 349
dnf) pkg_install "libimobiledevice-utils" ;; pacman) pkg_install "libimobiledevice" ;; *) manual "Install libimobiledevice from https://libimobiledevice.org/" ;; - Network accessline 350
pacman) pkg_install "libimobiledevice" ;; *) manual "Install libimobiledevice from https://libimobiledevice.org/" ;; esac - Network accessline 351
*) manual "Install libimobiledevice from https://libimobiledevice.org/" ;; - Network accessline 366
exit 0 else manual "Install Swift from https://swift.org/download/ to get swift-demangle" - Network accessline 367
else manual "Install Swift from https://swift.org/download/ to get swift-demangle" fi - Network accessline 368
manual "Install Swift from https://swift.org/download/ to get swift-demangle" - Network accessline 385
dnf) pkg_install "radare2" ;; pacman) pkg_install "radare2" ;; *) manual "Install radare2 from https://github.com/radareorg/radare2" ;; - Network accessline 386
pacman) pkg_install "radare2" ;; *) manual "Install radare2 from https://github.com/radareorg/radare2" ;; esac - Network accessline 387
*) manual "Install radare2 from https://github.com/radareorg/radare2" ;; - Network accessline 406
brew) pkg_install "rizin" ;; apt) pkg_install "rizin" ;; *) manual "Install rizin from https://github.com/rizinorg/rizin" ;; - Network accessline 407
apt) pkg_install "rizin" ;; *) manual "Install rizin from https://github.com/rizinorg/rizin" ;; esac - Network accessline 408
*) manual "Install rizin from https://github.com/rizinorg/rizin" ;; - Network accessline 433
manual "Download Ghidra from https://ghidra-sre.org/ and set GHIDRA_INSTALL_DIR"
skills/ios-reverse-engineering/scripts/lib/plist.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/ios-reverse-engineering/scripts/reversing-analyze.sh
- Executable scriptline 1
#!/usr/bin/env bash - Access to secretsline 255
[Credential-related source omitted] - Access to secretsline 301
[Credential-related source omitted] - Access to secretsline 311
[Credential-related source omitted] - Access to secretsline 314
[Credential-related source omitted] - Access to secretsline 401
[Credential-related source omitted] - Dangerous shell operationline 530
rm -rf "$GHIDRA_PROJECT" - Access to secretsline 563
[Credential-related source omitted]
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Declared and executed: 3 facts
- Contacts www.newosxbook.com, which SKILL.md, the README and the plugin manifest do not mentionios-reverse-engineering/scripts/install-dep.sh:295High confidence
- Contacts libimobiledevice.org, which SKILL.md, the README and the plugin manifest do not mentionios-reverse-engineering/scripts/install-dep.sh:351High confidence
- Contacts swift.org, which SKILL.md, the README and the plugin manifest do not mentionios-reverse-engineering/scripts/install-dep.sh:368High confidence
Signal confidence: 209 facts
- Access to secrets in the frontmatter of the SKILL.md: a variable, placeholder or call, not a stored valueios-reverse-engineering/SKILL.md:3Low confidence
- Access to secrets in prose of the SKILL.mdios-reverse-engineering/SKILL.md:92Low confidence
- Network access in code of the SKILL.mdios-reverse-engineering/SKILL.md:197High confidence
- Network access in code of the SKILL.mdios-reverse-engineering/SKILL.md:198High confidence
- Access to secrets in prose of the SKILL.mdios-reverse-engineering/SKILL.md:225Low confidence
- Access to secrets in prose of the SKILL.mdios-reverse-engineering/SKILL.md:383Low confidence
- Access to secrets in prose of the SKILL.md: a variable, placeholder or call, not a stored valueios-reverse-engineering/SKILL.md:542Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:34Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:77Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:105Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:141Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:222Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:223Low confidence
- Access to secrets in prose of documentationios-reverse-engineering/references/api-extraction-patterns.md:350Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:353Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:356Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:362Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:363Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:380Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:381Low confidence
- Network access in code of documentationios-reverse-engineering/references/api-extraction-patterns.md:382Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/call-flow-analysis.md:269Low confidence
- Access to secrets in prose of documentationios-reverse-engineering/references/call-flow-analysis.md:328Low confidence
- Network access in code of documentationios-reverse-engineering/references/class-dump-usage.md:11Low confidence
- Network access in code of documentationios-reverse-engineering/references/class-dump-usage.md:12Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:13Low confidence
- Access to secrets in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:32Low confidence
- Network access in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:41Low confidence
- Network access in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:42Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valueios-reverse-engineering/references/cloud-secrets-patterns.md:42Low confidence
- Network access in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:43Low confidence
- Network access in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:141Low confidence
- Network access in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:142Low confidence
- Network access in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:206Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:212Low confidence
- Network access in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:245Low confidence
- Network access in code of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:246Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valueios-reverse-engineering/references/cloud-secrets-patterns.md:267Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valueios-reverse-engineering/references/cloud-secrets-patterns.md:368Low confidence
- Network access in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:375Low confidence
- Network access in prose of documentationios-reverse-engineering/references/cloud-secrets-patterns.md:377Low confidence
- Network access in code of documentationios-reverse-engineering/references/reversing-tools-guide.md:65Low confidence
- Network access in code of documentationios-reverse-engineering/references/reversing-tools-guide.md:66Low confidence
- Network access in code of documentationios-reverse-engineering/references/reversing-tools-guide.md:128Low confidence
- Access to secrets in code of documentationios-reverse-engineering/references/reversing-tools-guide.md:213Low confidence
- Access to secrets in prose of documentationios-reverse-engineering/references/reversing-tools-guide.md:248Low confidence
- Access to secrets in code of documentation: a variable, placeholder or call, not a stored valueios-reverse-engineering/references/reversing-tools-guide.md:271Low confidence
- Access to secrets in prose of documentation: a variable, placeholder or call, not a stored valueios-reverse-engineering/references/sdk-fingerprinting.md:127Low confidence
- Dangerous shell operation in code of documentationios-reverse-engineering/references/setup-guide.md:39Low confidence
- Network access in code of documentationios-reverse-engineering/references/setup-guide.md:39Low confidence
and 159 more
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/ios-reverse-engineering/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
