Mobile iOS Whitebox Audit
When this skill applies
The user is reviewing an iOS target. Signals to look for:
- The target directory has an
Info.plist,*.swift,*.m,*.mm, or*.xcodeproj. - The conversation mentions WKWebView, NSURLSession, Keychain, ATS, KeychainAccess, ObjC runtime.
- A previous run produced
.claude/findings.jsonentries whosetypestarts withios-*.
Triage anchors
| Type | What to verify |
|---|---|
ios-ats-arbitrary-loads | The Info.plist has NSAllowsArbitraryLoads=true. Confirm whether any specific exempt domain is actually needed; otherwise this disables ATS for the entire app. |
ios-ats-partial-exemption | NSAllowsLocalNetworking / NSAllowsArbitraryLoadsForMedia widens trust. Inventory which hosts the app actually needs over HTTP. |
ios-keychain-accessible-always | kSecAttrAccessibleAlways / kSecAttrAccessibleAlwaysThisDeviceOnly lets locked-device attackers read the item. Switch to kSecAttrAccessibleWhenUnlockedThisDeviceOnly or kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly. |
ios-trust-all-ssl | URLSessionDelegate.urlSession(_:didReceive:completionHandler:) returns .useCredential, URLCredential(trust: serverTrust) without SecTrustEvaluate. Catastrophic — replace with explicit pinning. |
ios-uiwebview-deprecated | UIWebView is deprecated since iOS 12 and has known issues. Migrate to WKWebView. |
ios-webview-html-concat | loadHTMLString receives an interpolated/concatenated string. If any value originates from a network response or pasteboard, it renders attacker HTML/JS in the app origin. |
ios-webview-evaljs-concat | evaluateJavaScript builds the JS payload via Swift interpolation. Any escape from a string literal executes attacker JS in the WebView. |
Workflow: prefer /vuln-scout:mobile-audit
For iOS targets that include both source and bundle resources, point
/vuln-scout:mobile-audit at the project root. The driver discovers
*/Info.plist and Swift/ObjC sources under src/, Sources/, or
Application/.
If you have an extracted IPA, point the driver at the unzipped Payload
folder. The Info.plist will be at Payload/AppName.app/Info.plist.
Cross-platform parallels
Many of the high-signal Android detectors have an iOS analog. When you see a chain on Android, consider whether the iOS app has the same one:
| Android | iOS analog |
|---|---|
mobile-webview-js-injection | ios-webview-evaljs-concat |
mobile-nsc-narrow-pinning | ios-ats-partial-exemption, ios-trust-all-ssl |
mobile-shared-prefs-sensitive | ios-keychain-accessible-always, NSUserDefaults misuse |
mobile-insecure-tls | ios-trust-all-ssl |
See also [[mobile-android]] for the Android counterpart.