analyzing-ios-app-security-with-objection

Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.

Quality

69%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-ios-app-security-with-objection/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with copy-paste-ready commands and a clear 7-step workflow, but it suffers from missing validation checkpoints for destructive operations and a failure to use the existing bundle files, leaving valuable reference material unreferenced.

Suggestions

Add explicit validation/verification steps after destructive operations (e.g., confirm SSL pinning bypass, verify keychain dump output, re-check jailbreak-detection state) to lift workflow clarity above 3.

Link to the existing bundle files from the body (e.g., 'See references/api-reference.md for the full command catalog' and 'See scripts/process.py for automated assessment') so progressive disclosure is signaled and one level deep.

Trim the mild redundancy between the 'Key Concepts' table and the 'Tools & Systems' section to tighten conciseness.

Dimension	Reasoning	Score
Conciseness	The body is command-dense and assumes Claude's intelligence with no padding about basic concepts, though the 'Tools & Systems' section mildly restates material already in the 'Key Concepts' table.	4 / 5
Actionability	Every step provides copy-paste-ready, executable Objection/Frida commands with concrete arguments covering the common iOS assessment cases end-to-end.	5 / 5
Workflow Clarity	The 7-step sequence is clear and well-ordered, but the destructive/runtime-modifying operations (SSL pinning bypass, jailbreak disable, memory dumps, keychain dumps) lack validation/verification checkpoints, which caps workflow clarity at 3.	3 / 5
Progressive Disclosure	Five bundle files exist (references/api-reference.md, standards.md, workflows.md; scripts/agent.py, process.py; assets/template.md) but the body references none of them; command reference that belongs in those files is inlined with no navigation signals.	2 / 5
	Total	14 / 20 Passed

Description

70%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinct, and rich in natural trigger terms, cleanly stating what the skill does. Its main weakness is the absence of an explicit 'Use when...' trigger clause, leaving the 'when' only weakly implied.

Suggestions

Add an explicit 'Use when...' trigger clause (e.g., 'Use when performing runtime iOS app security testing, bypassing SSL pinning or jailbreak detection, or dumping keychain/filesystem data during authorized mobile assessments.') to lift completeness.

Include common synonym trigger terms such as 'SSL pinning', 'jailbreak detection', and 'Frida' as natural phrases users would say.

Dimension	Reasoning	Score
Specificity	Names three concrete actions ('inspect keychain and filesystem data', 'explore app internals at runtime', 'validate/bypass client-side protections') with the tool/domain clear, but coverage is not fully comprehensive enough for a 5.	4 / 5
Completeness	The 'what' is explicit, but 'when' is only a context qualifier ('during authorized mobile assessments') rather than an explicit 'Use when...' trigger clause, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Strong domain-natural keywords ('iOS app security testing', 'keychain', 'filesystem', 'client-side protections') that a tester would say, though common synonyms like 'SSL pinning' or 'jailbreak detection' are absent.	4 / 5
Distinctiveness Conflict Risk	A clear niche is named (runtime iOS security testing with Objection/Frida) with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	16 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-ios-app-security-with-objection/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.