From ios-forensics
Hunt for mercenary iOS spyware — Pegasus, Predator, QuaDream, RCS, Hermit. Correlates STIX IoCs across SMS, Safari, Manifest.db, datausage, and shutdown_log, and pivots hits into concrete evidence. Use after triage surfaces a STIX match or on any device where mercenary spyware is plausible.
How this skill is triggered — by the user, by Claude, or both
Slash command
/ios-forensics:spyware-huntThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- Triage surfaced a STIX match (any module's `_detected` entry)
_detected entry)mvt_check_iocs(source, iocs="/path/to/amnesty-ioc.stix2.json",
source_kind="backup" | "fs")
Read <module>_detected entries. Each hit is authoritative — Amnesty's indicators are curated and versioned.
For every hit: note module, record, matched indicator (domain / process / file path), and the IoC's provenance field (which family / campaign).
mvt_shutdown_log. The log records processes holding shutdown. Pegasus and related implants frequently appear with short, generic names. Compare against a baseline (clean reference device on matching iOS).
/private/var/db/com.apple.xpc.roleaccountd.staging entries — high signalmvt_datausage. Spyware needs to exfiltrate — it shows up in DataUsage.sqlite:
mvt_installed_appsZFIRSTTIMESTAMP ≈ ZTIMESTAMP (process lived briefly, exfil'd, died)Pivot any suspect process into ios_backup_list path_substring=<proc> to find logs or caches naming it.
Zero-click iMessage exploits leave partial traces:
mvt_sms_messages iocs=... — URLs in messages matching Pegasus / Predator delivery domainssms.db via ios_backup_extract domain=HomeDomain relative_path=Library/SMS/sms.db and run ios_sqlite_query for messages around the suspected compromise window; look for short-lived threads with unusual sendersmvt_run_module → imagent_crashes style modules (via FFS, .ips crash files mentioning imagent, MessagesBlastDoorService, mediaserverd, WebKit)mvt_safari_history iocs=... — one-click delivery domainsmvt_run_module webkit_session_resource_log and webkit_resource_load_statistics — resources loaded across sites, a rich record of one-click attack chainsWebKit/Databases SQLites for per-site storage anomaliesmvt_manifest iocs=... scans Manifest.db paths/domains against STIX. Additionally:
ios_backup_list path_substring="com.apple.xpc.roleaccountd"
ios_backup_list path_substring="staging"
ios_backup_list path_substring=".plist.db"
Any unexpected hit in system domains is an investigate-immediately.
Pull every timestamp you've collected — shutdown_log entries, datausage first-seen, suspicious SMS receipt, unusual Safari hit, configuration profile install — into a single ordered timeline. A Pegasus infection typically looks like:
T+0 suspicious iMessage / Safari hit
T+0..T+60s imagent / MessagesBlastDoorService / mediaserverd crash (FFS .ips)
T+0..T+hours unknown process in datausage, short-lived
T+days anomalous shutdown_log entries
If your evidence lines up on that shape, confidence is "likely" even without a direct STIX hit.
For every confirmed or likely finding:
ios_backup_extract the originating DB / plistmvt_check_iocs across related devicesMVT's STIX2 format accepts domain-name, url, file:hashes.'SHA-256', email-addr, ipv4-addr, process:name. For a one-shot custom IoC, write the minimal STIX2 JSON and pass it via the iocs parameter — the same data model the public feeds use.
For each finding, state: family (best match from STIX provenance), confidence (confirmed / likely / suspected), artifacts, timeline, delivery vector (iMessage / Safari / Mail / WhatsApp / social), and whether the device is still compromised (evidence only, or active C2 in datausage / shutdown_log).
Provides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub s3cr1z/capabilities --plugin ios-forensics