[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVWN0CB7S0293FTGKHWVJB":3,"skill-same:01M6EVWN0CB7S0293FTGKHWVJB":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6EVWN0CB7S0293FTGKHWVJB","performing-ios-app-security-assessment",null,"Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ios-app-security-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"security","app","assessment","ios","app security","ios app","performing ios app security assessment","security assessment","ipa-analysis","de","exploration","mobile","cm","review","keychain","ssl-pinning","analysis","t1078","cybersecurity","application security","2026-11-10 10:12:30",false,"---\nname: performing-ios-app-security-assessment\ndescription: 'Performs comprehensive iOS application security assessments using Frida\n  for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass\n  for traffic interception, keychain extraction for credential analysis, and IPA static\n  analysis for binary-level review. Use when conducting authorized iOS penetration\n  tests, evaluating mobile app security posture against OWASP MASTG, or assessing\n  iOS app data protection and transport security controls. Activates for requests\n  involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning\n  bypass, or IPA reverse engineering.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mukul975\ntags:\n- mobile-security\n- ios\n- frida\n- objection\n- ssl-pinning\n- keychain\n- ipa-analysis\n- owasp-mastg\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1003\n---\n# Performing iOS App Security Assessment\n\n## Disclaimer\n\nThis skill is intended for authorized security testing, penetration testing engagements, CTF competitions, and educational purposes only. Unauthorized access to applications or devices is illegal. Always obtain written authorization before performing any security assessment. Misuse of these techniques may violate computer fraud and abuse laws in your jurisdiction.\n\n## When to Use\n\nUse this skill when:\n- Conducting authorized penetration tests of iOS applications against OWASP MASVS\u002FMASTG criteria\n- Performing dynamic analysis of iOS apps using Frida instrumentation and Objection runtime exploration\n- Bypassing SSL\u002FTLS certificate pinning to intercept and analyze app network traffic through a proxy\n- Extracting and auditing iOS Keychain contents for insecure credential storage practices\n- Performing static analysis of IPA packages to identify hardcoded secrets, entitlements, and binary protections\n- Assessing jailbreak detection and anti-tampering controls in iOS applications\n\n**Do not use** against applications without explicit written authorization. Do not use on production devices containing real user data unless the engagement scope permits it.\n\n## Prerequisites\n\n- Python 3.10+ with pip\n- Frida toolkit: `pip install frida-tools frida`\n- Objection: `pip install objection`\n- Target iOS device (jailbroken with frida-server, or non-jailbroken with patched IPA)\n- macOS with Xcode command-line tools (recommended for code signing and ideviceinstaller)\n- Burp Suite or mitmproxy for traffic interception after SSL pinning bypass\n- For jailbroken devices: SSH access and frida-server running on the device\n- For non-jailbroken devices: Apple Developer certificate for IPA re-signing\n\n## Workflow\n\n### Step 1: IPA Static Analysis\n\nExtract and analyze the IPA binary before runtime testing:\n\n```bash\n# Unzip IPA for static analysis\nunzip target.ipa -d target_app\u002F\n\n# Check binary architectures and protections\notool -hv target_app\u002FPayload\u002F*.app\u002FAppExecutable\notool -l target_app\u002FPayload\u002F*.app\u002FAppExecutable | grep -A4 LC_ENCRYPTION\n\n# Extract Info.plist for entitlements and URL schemes\nplutil -p target_app\u002FPayload\u002F*.app\u002FInfo.plist\n\n# Search for hardcoded secrets in binary strings\nstrings target_app\u002FPayload\u002F*.app\u002FAppExecutable | grep -iE \"api[_-]?key|secret|password|token|firebase\"\n\n# Check embedded provisioning profile\nsecurity cms -D -i target_app\u002FPayload\u002F*.app\u002Fembedded.mobileprovision\n\n# Identify linked frameworks\notool -L target_app\u002FPayload\u002F*.app\u002FAppExecutable\n```\n\n### Step 2: Environment Setup and Frida Attachment\n\n```bash\n# For jailbroken device: verify Frida server is running\nfrida-ps -U\n\n# Spawn target app with Frida\nfrida -U -f com.target.app --no-pause\n\n# For non-jailbroken device: patch IPA with Frida Gadget\nobjection patchipa --source target.ipa --codesign-signature \"Apple Development: tester@example.com\"\n\n# Install patched IPA\nideviceinstaller -i target-patched.ipa\n\n# Attach Objection to running app\nobjection --gadget \"com.target.app\" explore\n```\n\n### Step 3: SSL Pinning Bypass\n\nBypass certificate pinning to enable traffic interception:\n\n```bash\n# Using Objection's built-in bypass\nobjection --gadget \"com.target.app\" explore --startup-command \"ios sslpinning disable\"\n\n# Using Frida script for more comprehensive bypass\nfrida -U -f com.target.app -l ssl_pinning_bypass.js --no-pause\n\n# Verify bypass by configuring device proxy to Burp Suite\n# Device Settings -> Wi-Fi -> HTTP Proxy -> Manual -> \u003Cburp_ip>:8080\n# Install Burp CA certificate on device via http:\u002F\u002F\u003Cburp_ip>:8080\u002Fcert\n```\n\nThe Frida SSL pinning bypass script hooks into NSURLSession, NSURLConnection, and\nAFNetworking\u002FAlamofire trust evaluation delegates to override certificate validation\nat the TLS handshake level.\n\n### Step 4: Keychain Extraction and Credential Analysis\n\n```bash\n# Dump all accessible keychain items via Objection\nios keychain dump\n\n# Dump keychain with raw data output\nios keychain dump --json\n\n# Check keychain item accessibility attributes\n# Items with kSecAttrAccessibleAlways or kSecAttrAccessibleAfterFirstUnlock\n# are accessible without device unlock - this is a finding\n\n# Search for specific credential types\nios keychain dump | grep -i \"password\\|token\\|secret\\|oauth\"\n\n# Inspect NSUserDefaults for sensitive data leaks\nios nsuserdefaults get\n\n# Check for sensitive data in app cookies\nios cookies get\n```\n\n### Step 5: Runtime Method Hooking and Analysis\n\n```bash\n# List all loaded classes\nios hooking list classes\n\n# Search for security-relevant classes\nios hooking search classes Auth\nios hooking search classes Crypto\nios hooking search classes Biometric\nios hooking search classes Jailbreak\n\n# Hook authentication methods to observe parameters and return values\nios hooking watch method \"+[AuthManager validateCredentials:password:]\" --dump-args --dump-return\n\n# Monitor biometric authentication (LocalAuthentication framework)\nios hooking watch class LAContext\n\n# Bypass jailbreak detection\nios jailbreak disable\n\n# Search memory for sensitive strings\nmemory search \"Bearer \" --string\nmemory search \"password\" --string\n\n# Dump loaded modules for third-party library identification\nmemory list modules\n```\n\n### Step 6: Data Storage Assessment\n\n```bash\n# List files in app sandbox\nenv\n\n# Check for SQLite databases with sensitive data\nsqlite connect Documents\u002Fapp.db\nsqlite execute query \"SELECT name FROM sqlite_master WHERE type='table'\"\n\n# Inspect plist files for cached credentials\nios plist cat Library\u002FPreferences\u002Fcom.target.app.plist\n\n# Check for sensitive data in app caches\nfind Library\u002FCaches\u002F -type f\n\n# Monitor pasteboard for credential leakage\nios pasteboard monitor\n\n# Check binary cookies\nios cookies get\n```\n\n### Step 7: Network and Transport Security Assessment\n\nAfter SSL pinning bypass, analyze intercepted traffic:\n\n```bash\n# Verify App Transport Security (ATS) configuration in Info.plist\n# Check for NSAllowsArbitraryLoads = true (disables ATS)\nios plist cat Info.plist | grep -A5 NSAppTransportSecurity\n\n# Hook URL session delegates to monitor all network calls\nios hooking watch class NSURLSession\nios hooking watch class NSURLSessionConfiguration\n\n# Check for certificate transparency validation\nios hooking search classes CT\nios hooking search classes Certificate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Frida** | Dynamic instrumentation toolkit that injects a JavaScript engine into target processes, enabling runtime hooking, tracing, and modification of iOS app behavior |\n| **Objection** | Runtime mobile exploration toolkit built on Frida providing pre-built commands for common security tests including keychain dump, SSL pinning bypass, and method hooking |\n| **SSL Pinning** | Client-side certificate validation that restricts which TLS certificates the app trusts, preventing proxy-based traffic interception; bypassed by hooking trust evaluation functions |\n| **Keychain** | iOS secure storage API for credentials and tokens; items have accessibility attributes that control when they can be read (e.g., only when device is unlocked) |\n| **IPA** | iOS App Store Package; a ZIP archive containing the app binary, frameworks, assets, and provisioning profile that can be extracted for static analysis |\n| **OWASP MASTG** | Mobile Application Security Testing Guide; comprehensive methodology for iOS and Android security testing organized by MASVS verification categories |\n| **Frida Gadget** | Shared library (.dylib) injected into IPA for non-jailbroken testing; enables Frida instrumentation without requiring a jailbroken device |\n| **Method Swizzling** | Objective-C runtime technique that exchanges method implementations at runtime; used by Frida to intercept and modify method behavior |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation framework for injecting JavaScript into native app processes at runtime\n- **Objection**: High-level Frida-powered mobile security toolkit with pre-built exploration commands\n- **frida-tools**: CLI utilities including frida-ps (process listing), frida-trace (method tracing), frida-discover (API discovery)\n- **Burp Suite**: HTTP\u002FHTTPS interception proxy used to analyze app traffic after SSL pinning bypass\n- **ideviceinstaller**: Cross-platform CLI tool for installing and managing iOS apps over USB\n- **otool \u002F rabin2**: Binary analysis tools for inspecting Mach-O headers, linked libraries, and encryption info\n- **Cycript \u002F Frida REPL**: Interactive consoles for exploring Objective-C runtime and modifying objects in memory\n\n## Common Pitfalls\n\n- **Frida detection crashes the app**: Some apps implement Frida detection by scanning for frida-server process names, Frida's RPC ports, or gadget signatures. Use `--startup-command` to hook detection checks before they execute, or rename frida-server binary.\n- **Keychain scope limitation**: Objection can only access keychain items within the app's keychain access group. System-wide keychain items require jailbreak-level tools like keychain-dumper.\n- **Swift name mangling**: Swift method names are mangled in the Objective-C runtime. Use `ios hooking list classes` and grep for demangled names, or use frida-trace with wildcard patterns.\n- **App Transport Security enforcement**: ATS may block your proxy connections even after SSL pinning bypass. Verify the Info.plist ATS configuration allows your proxy's certificate chain.\n- **Code signing invalidation**: Patching an IPA with Frida Gadget invalidates the original code signature. You need a valid Apple Developer certificate to re-sign the patched IPA.\n- **Non-persistent modifications**: All Frida\u002FObjection hooks are runtime-only and reset when the app restarts. Document findings and capture evidence immediately.\n\n## Output Format\n\n```\n## Finding: Insecure Keychain Storage with kSecAttrAccessibleAlways\n\n**ID**: IOS-001\n**Severity**: High (CVSS 7.5)\n**OWASP MASTG**: MASTG-TEST-0055 (Testing Data Storage)\n**MASVS Category**: MASVS-STORAGE\n\n**Description**:\nThe application stores OAuth refresh tokens in the iOS Keychain with\nthe accessibility attribute kSecAttrAccessibleAlways, making them\nreadable even when the device is locked or after a reboot without\nuser authentication.\n\n**Proof of Concept**:\n1. Attach Objection to com.target.app: objection --gadget com.target.app explore\n2. Execute: ios keychain dump\n3. Observe refresh_token item with Accessible: kSecAttrAccessibleAlways\n4. Token value is accessible without device unlock\n\n**Impact**:\nAn attacker with physical access to a locked device or forensic\nimage can extract OAuth refresh tokens and gain persistent access\nto the user's account without knowing device passcode.\n\n**Remediation**:\nStore sensitive credentials with kSecAttrAccessibleWhenUnlockedThisDeviceOnly\nand enable biometric protection via kSecAccessControlBiometryCurrentSet.\n```\n","# Performing iOS App Security Assessment\n\n## Disclaimer\n\nThis skill is intended for authorized security testing, penetration testing engagements, CTF competitions, and educational purposes only. Unauthorized access to applications or devices is illegal. Always obtain written authorization before performing any security assessment. Misuse of these techniques may violate computer fraud and abuse laws in your jurisdiction.\n\n## When to Use\n\nUse this skill when:\n- Conducting authorized penetration tests of iOS applications against OWASP MASVS\u002FMASTG criteria\n- Performing dynamic analysis of iOS apps using Frida instrumentation and Objection runtime exploration\n- Bypassing SSL\u002FTLS certificate pinning to intercept and analyze app network traffic through a proxy\n- Extracting and auditing iOS Keychain contents for insecure credential storage practices\n- Performing static analysis of IPA packages to identify hardcoded secrets, entitlements, and binary protections\n- Assessing jailbreak detection and anti-tampering controls in iOS applications\n\n**Do not use** against applications without explicit written authorization. Do not use on production devices containing real user data unless the engagement scope permits it.\n\n## Prerequisites\n\n- Python 3.10+ with pip\n- Frida toolkit: `pip install frida-tools frida`\n- Objection: `pip install objection`\n- Target iOS device (jailbroken with frida-server, or non-jailbroken with patched IPA)\n- macOS with Xcode command-line tools (recommended for code signing and ideviceinstaller)\n- Burp Suite or mitmproxy for traffic interception after SSL pinning bypass\n- For jailbroken devices: SSH access and frida-server running on the device\n- For non-jailbroken devices: Apple Developer certificate for IPA re-signing\n\n## Workflow\n\n### Step 1: IPA Static Analysis\n\nExtract and analyze the IPA binary before runtime testing:\n\n```bash\n# Unzip IPA for static analysis\nunzip target.ipa -d target_app\u002F\n\n# Check binary architectures and protections\notool -hv target_app\u002FPayload\u002F*.app\u002FAppExecutable\notool -l target_app\u002FPayload\u002F*.app\u002FAppExecutable | grep -A4 LC_ENCRYPTION\n\n# Extract Info.plist for entitlements and URL schemes\nplutil -p target_app\u002FPayload\u002F*.app\u002FInfo.plist\n\n# Search for hardcoded secrets in binary strings\nstrings target_app\u002FPayload\u002F*.app\u002FAppExecutable | grep -iE \"api[_-]?key|secret|password|token|firebase\"\n\n# Check embedded provisioning profile\nsecurity cms -D -i target_app\u002FPayload\u002F*.app\u002Fembedded.mobileprovision\n\n# Identify linked frameworks\notool -L target_app\u002FPayload\u002F*.app\u002FAppExecutable\n```\n\n### Step 2: Environment Setup and Frida Attachment\n\n```bash\n# For jailbroken device: verify Frida server is running\nfrida-ps -U\n\n# Spawn target app with Frida\nfrida -U -f com.target.app --no-pause\n\n# For non-jailbroken device: patch IPA with Frida Gadget\nobjection patchipa --source target.ipa --codesign-signature \"Apple Development: tester@example.com\"\n\n# Install patched IPA\nideviceinstaller -i target-patched.ipa\n\n# Attach Objection to running app\nobjection --gadget \"com.target.app\" explore\n```\n\n### Step 3: SSL Pinning Bypass\n\nBypass certificate pinning to enable traffic interception:\n\n```bash\n# Using Objection's built-in bypass\nobjection --gadget \"com.target.app\" explore --startup-command \"ios sslpinning disable\"\n\n# Using Frida script for more comprehensive bypass\nfrida -U -f com.target.app -l ssl_pinning_bypass.js --no-pause\n\n# Verify bypass by configuring device proxy to Burp Suite\n# Device Settings -> Wi-Fi -> HTTP Proxy -> Manual -> \u003Cburp_ip>:8080\n# Install Burp CA certificate on device via http:\u002F\u002F\u003Cburp_ip>:8080\u002Fcert\n```\n\nThe Frida SSL pinning bypass script hooks into NSURLSession, NSURLConnection, and\nAFNetworking\u002FAlamofire trust evaluation delegates to override certificate validation\nat the TLS handshake level.\n\n### Step 4: Keychain Extraction and Credential Analysis\n\n```bash\n# Dump all accessible keychain items via Objection\nios keychain dump\n\n# Dump keychain with raw data output\nios keychain dump --json\n\n# Check keychain item accessibility attributes\n# Items with kSecAttrAccessibleAlways or kSecAttrAccessibleAfterFirstUnlock\n# are accessible without device unlock - this is a finding\n\n# Search for specific credential types\nios keychain dump | grep -i \"password\\|token\\|secret\\|oauth\"\n\n# Inspect NSUserDefaults for sensitive data leaks\nios nsuserdefaults get\n\n# Check for sensitive data in app cookies\nios cookies get\n```\n\n### Step 5: Runtime Method Hooking and Analysis\n\n```bash\n# List all loaded classes\nios hooking list classes\n\n# Search for security-relevant classes\nios hooking search classes Auth\nios hooking search classes Crypto\nios hooking search classes Biometric\nios hooking search classes Jailbreak\n\n# Hook authentication methods to observe parameters and return values\nios hooking watch method \"+[AuthManager validateCredentials:password:]\" --dump-args --dump-return\n\n# Monitor biometric authentication (LocalAuthentication framework)\nios hooking watch class LAContext\n\n# Bypass jailbreak detection\nios jailbreak disable\n\n# Search memory for sensitive strings\nmemory search \"Bearer \" --string\nmemory search \"password\" --string\n\n# Dump loaded modules for third-party library identification\nmemory list modules\n```\n\n### Step 6: Data Storage Assessment\n\n```bash\n# List files in app sandbox\nenv\n\n# Check for SQLite databases with sensitive data\nsqlite connect Documents\u002Fapp.db\nsqlite execute query \"SELECT name FROM sqlite_master WHERE type='table'\"\n\n# Inspect plist files for cached credentials\nios plist cat Library\u002FPreferences\u002Fcom.target.app.plist\n\n# Check for sensitive data in app caches\nfind Library\u002FCaches\u002F -type f\n\n# Monitor pasteboard for credential leakage\nios pasteboard monitor\n\n# Check binary cookies\nios cookies get\n```\n\n### Step 7: Network and Transport Security Assessment\n\nAfter SSL pinning bypass, analyze intercepted traffic:\n\n```bash\n# Verify App Transport Security (ATS) configuration in Info.plist\n# Check for NSAllowsArbitraryLoads = true (disables ATS)\nios plist cat Info.plist | grep -A5 NSAppTransportSecurity\n\n# Hook URL session delegates to monitor all network calls\nios hooking watch class NSURLSession\nios hooking watch class NSURLSessionConfiguration\n\n# Check for certificate transparency validation\nios hooking search classes CT\nios hooking search classes Certificate\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Frida** | Dynamic instrumentation toolkit that injects a JavaScript engine into target processes, enabling runtime hooking, tracing, and modification of iOS app behavior |\n| **Objection** | Runtime mobile exploration toolkit built on Frida providing pre-built commands for common security tests including keychain dump, SSL pinning bypass, and method hooking |\n| **SSL Pinning** | Client-side certificate validation that restricts which TLS certificates the app trusts, preventing proxy-based traffic interception; bypassed by hooking trust evaluation functions |\n| **Keychain** | iOS secure storage API for credentials and tokens; items have accessibility attributes that control when they can be read (e.g., only when device is unlocked) |\n| **IPA** | iOS App Store Package; a ZIP archive containing the app binary, frameworks, assets, and provisioning profile that can be extracted for static analysis |\n| **OWASP MASTG** | Mobile Application Security Testing Guide; comprehensive methodology for iOS and Android security testing organized by MASVS verification categories |\n| **Frida Gadget** | Shared library (.dylib) injected into IPA for non-jailbroken testing; enables Frida instrumentation without requiring a jailbroken device |\n| **Method Swizzling** | Objective-C runtime technique that exchanges method implementations at runtime; used by Frida to intercept and modify method behavior |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation framework for injecting JavaScript into native app processes at runtime\n- **Objection**: High-level Frida-powered mobile security toolkit with pre-built exploration commands\n- **frida-tools**: CLI utilities including frida-ps (process listing), frida-trace (method tracing), frida-discover (API discovery)\n- **Burp Suite**: HTTP\u002FHTTPS interception proxy used to analyze app traffic after SSL pinning bypass\n- **ideviceinstaller**: Cross-platform CLI tool for installing and managing iOS apps over USB\n- **otool \u002F rabin2**: Binary analysis tools for inspecting Mach-O headers, linked libraries, and encryption info\n- **Cycript \u002F Frida REPL**: Interactive consoles for exploring Objective-C runtime and modifying objects in memory\n\n## Common Pitfalls\n\n- **Frida detection crashes the app**: Some apps implement Frida detection by scanning for frida-server process names, Frida's RPC ports, or gadget signatures. Use `--startup-command` to hook detection checks before they execute, or rename frida-server binary.\n- **Keychain scope limitation**: Objection can only access keychain items within the app's keychain access group. System-wide keychain items require jailbreak-level tools like keychain-dumper.\n- **Swift name mangling**: Swift method names are mangled in the Objective-C runtime. Use `ios hooking list classes` and grep for demangled names, or use frida-trace with wildcard patterns.\n- **App Transport Security enforcement**: ATS may block your proxy connections even after SSL pinning bypass. Verify the Info.plist ATS configuration allows your proxy's certificate chain.\n- **Code signing invalidation**: Patching an IPA with Frida Gadget invalidates the original code signature. You need a valid Apple Developer certificate to re-sign the patched IPA.\n- **Non-persistent modifications**: All Frida\u002FObjection hooks are runtime-only and reset when the app restarts. Document findings and capture evidence immediately.\n\n## Output Format\n\n```\n## Finding: Insecure Keychain Storage with kSecAttrAccessibleAlways\n\n**ID**: IOS-001\n**Severity**: High (CVSS 7.5)\n**OWASP MASTG**: MASTG-TEST-0055 (Testing Data Storage)\n**MASVS Category**: MASVS-STORAGE\n\n**Description**:\nThe application stores OAuth refresh tokens in the iOS Keychain with\nthe accessibility attribute kSecAttrAccessibleAlways, making them\nreadable even when the device is locked or after a reboot without\nuser authentication.\n\n**Proof of Concept**:\n1. Attach Objection to com.target.app: objection --gadget com.target.app explore\n2. Execute: ios keychain dump\n3. Observe refresh_token item with Accessible: kSecAttrAccessibleAlways\n4. Token value is accessible without device unlock\n\n**Impact**:\nAn attacker with physical access to a locked device or forensic\nimage can extract OAuth refresh tokens and gain persistent access\nto the user's account without knowing device passcode.\n\n**Remediation**:\nStore sensitive credentials with kSecAttrAccessibleWhenUnlockedThisDeviceOnly\nand enable biometric protection via kSecAccessControlBiometryCurrentSet.\n```\n",{"name":5,"tags":49,"author":54,"domain":42,"license":15,"version":55,"nist_csf":56,"subdomain":50,"description":61,"mitre_attack":62},[50,27,51,52,39,38,32,53],"mobile-security","frida","objection","owasp-mastg","mukul975","1.0.0",[57,58,59,60],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.\n",[63,64,65,66,67],"T1059","T1056","T1036","T1078","T1003","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-ios-app-security-assessment","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-ios-app-security-assessment",{"tool":82,"command":83},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-ios-app-security-assessment",{"tool":85,"command":86},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-ios-app-security-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ios-app-security-assessment\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ios-app-security-assessment\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",4346,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ios-app-security-assessment\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",23944,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-ios-app-security-assessment\u002Fscripts\u002Fagent.py",[108,149,158,167,189,213],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":129,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[115,118,121,124],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":150,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":157,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[153,154,155,156],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":159,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,200,201,202,40,203,204,205,206,141,142,207,34,208,209,210,211,212],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","options","stress-test","strategies","scenario","stress",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":229,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[219,222,225,226],{"categoryNo":220,"categoryName":221,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":223,"categoryName":224,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":227,"categoryName":228,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000036","内容创作者",[230,231,232,233,234,235,236,237,138,238,141,142,143,239,240,241,242,243,188,244],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]