Stats
Actions
Tags
From ios-forensics
Review iOS configuration surfaces that enable persistence or surveillance — configuration profiles, MDM, TCC grants, provisioning profiles, VPN, root CAs, WebClips, jailbreak indicators, and sideloaded enterprise apps.
How this skill is triggered — by the user, by Claude, or both
Slash command
/ios-forensics:config-and-persistence-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- Triage flagged a profile, unusual TCC grant, or sideloaded app
/etc/apt, Sileo, Cydia, Dopamine, palera1n artifactsmvt_configuration_profiles(source, iocs=<optional>)
For each profile, record:
PayloadRemovalDisallowed = stickier persistence)Score each profile:
PayloadRemovalDisallowed=true on a profile the user can't explain → high prioritymvt_run_module(source, module="id_status_cache") # iMessage id_status_cache (ID / cert linkage)
ios_backup_list(backup_dir, path_substring="TrustStore")
Extract TrustStore.sqlite3 if present and enumerate trusted roots. Any non-Apple, non-public-CA root with an enterprise-looking subject → investigate.
mvt_tcc(source)
mvt_installed_apps(source)
ios_backup_list(backup_dir, path_substring="embedded.mobileprovision")
Extract each embedded.mobileprovision — it's a CMS-signed plist — via ios_backup_extract then ios_read_plist after stripping the CMS envelope (or use security cms -D offline). For each:
AppIDName, TeamName, TeamIdentifierProvisionedDevices — if your target's UDID is present on an unfamiliar team, someone enrolled themEntitlements — elevated entitlements (com.apple.developer.kernel.*, com.apple.security.*) on a random app are a big dealApp categories to flag:
iTunesMetadata.plist missing / non-App-Store source)Configuration profile payloads already surface VPN + proxy. Additionally:
ios_backup_list(backup_dir, path_substring="com.apple.networkextension")
ios_backup_list(backup_dir, path_substring="preferences.plist")
Extract relevant plists. Look for:
ios_backup_list(backup_dir, path_substring="WebClips")
Each WebClip is a plist (Info.plist) with URL, Title, optional FullScreen. Attackers seed home-screen WebClips that look like bank / login apps.
Backups don't capture /Applications system directories, but some artifacts leak:
Sileo, Cydia, Zebra, Installer, Dopamine, palera1norg.coolstar., com.saurik., xyz.willy., com.opa334./etc/apt, /var/jb, /bin/bash, /usr/libexec/cydia presenceNot every jailbreak is malicious, but it materially changes the threat model — note it and adjust downstream findings accordingly.
Extract com.apple.accountsd/Library/Accounts/Accounts4.sqlite (path varies) and the com.apple.imservice.ids.FaceTime / ids-pair-device-long-term-public-key keychain items.
Group findings by surface (profiles, TCC, sideloaded apps, root CAs, etc.). For each entry state: install date, issuer, removal policy, risk verdict, recommended action (remove profile / revoke TCC / uninstall app / rotate Apple ID / factory reset).
Finish with a survivability table:
| Cleanup action | What it removes |
|---|---|
| Remove profile | That profile only |
| Settings → General → Reset → Reset All Settings | Most profiles, Wi-Fi, VPN |
| Erase All Content and Settings | Profiles, apps, TCC, keychain, Apple-ID-tied data stays in iCloud |
| Device replacement + new Apple ID | Only guarantee against determined supply-chain / iCloud-resident implants |
PayloadRemovalDisallowed) that survive user-initiated settings resetsnpx claudepluginhub s3cr1z/capabilities --plugin ios-forensicsProvides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.