CtrlK
BlogDocsLog inGet started
Tessl Logo

competition-ios-runtime

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

70

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-organized and lean, with sound progressive disclosure to a real reference. It is weaker on actionability (directional rather than executable) and workflow_clarity (no explicit validation loop around the risky pinning-bypass step).

Suggestions

Add at least one concrete executable snippet per phase — e.g., a sample `frida` hook template, `plutil -p Info.plist`, or a `security`/keychain-dumper command — so guidance is copy-paste ready, not just directional.

Insert an explicit validation checkpoint after the bypass step (e.g., "confirm the accepted request path is still reached and semantics are unchanged before replaying; if not, narrow the bypass and re-check") to turn the risky patch into a validate→fix→retry loop.

Tie each Workflow phase back to a concrete verification artifact the analyst should produce (a labeled hook log + correlated static location) so 'done' is unambiguous for each step.

DimensionReasoningScore

Conciseness

The ~45-line body is lean and focused; it names concrete targets without tutorializing Frida/Keychain/pinning concepts Claude already knows, and every section earns its place.

3 / 3

Actionability

It names precise targets (selectors, plist keys, Keychain reads, request builders) but gives directional guidance rather than executable commands or sample frida/plutil/keychain-dumper invocations, leaving the "how" incomplete.

2 / 3

Workflow Clarity

Quick Start plus a 3-phase sequence is clearly structured with a correlation checkpoint, but pinning/environment bypass is a risky operation with no explicit validate→fix→retry loop, which the rubric caps at 2.

2 / 3

Progressive Disclosure

A concise overview offloads detail to a single clearly-signaled, verified one-level-deep reference (`references/ios-runtime.md`) that contains the promised hook targets, storage checklist, and evidence guidance.

3 / 3

Total

10

/

12

Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: specific, rich in natural trigger terms, fully answering what and when, and clearly niched with an explicit downstream-routing guard. No changes needed.

DimensionReasoningScore

Specificity

Lists multiple concrete actions across the iOS runtime domain — "IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery" — matching the comprehensive-action anchor.

3 / 3

Completeness

Explicitly answers both what (the enumerated workflow actions) and when (an explicit "Use when the user asks..." trigger clause), satisfying the top anchor.

3 / 3

Trigger Term Quality

The "Use when the user asks to hook an IPA, trace... runtime behavior, inspect Keychain or plist state, bypass pinning, analyze deeplinks or universal links, or replay accepted iOS requests" clause uses natural phrasings a user would actually say, with good coverage.

3 / 3

Distinctiveness Conflict Risk

Carves a clear iOS-runtime niche and explicitly scopes itself as downstream of `$ctf-sandbox-orchestrator` ("Use only after... has already established sandbox assumptions and routed here"), sharply reducing conflict with sibling skills.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
zhaoxuya520/reverse-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.