ClawHub
Back to skill

Security audit

Iphone Use

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly meant to control a real iPhone, but its update/install guidance relies on an unverified remote shell installer that creates persistent software on the Mac.

Review this skill carefully before installing. Only use it with a phone and Mac you control, protect the daemon token, avoid unattended payment or 2FA flows, and do not run the documented curl | sh installer unless you have independently reviewed or pinned the installer and understand the LaunchAgent it creates.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:173
Finding

Mutable Remote Installer Executed Directly with Cross-Session Persistence

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 13 and line 173
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T06: System Persistence
Risk Level: Critical

Vulnerable code and related documentation:

markdown
(setup: see the repo README; `install.sh` registers it as a LaunchAgent).
bash
daemon: curl -fsSL https://raw.githubusercontent.com/leeguooooo/iphone-use/main/install.sh | sh

Technical Analysis

The update instructions download install.sh from the mutable main branch of a personal GitHub repository and pipe the response directly into sh. The payload is neither version-pinned nor protected by a published checksum or cryptographic signature. It is also not saved for inspection before execution. Consequently, the effective code executed by this Skill can change after the reviewed Skill package has been published.

Piping a network response directly to a shell creates an arbitrary-code-execution channel under the privileges of the user invoking the command. Compromise of the repository, maintainer account, release process, or network trust chain could replace the installer with malicious commands. The documentation further states that the installer registers the daemon as a macOS LaunchAgent, causing installed code to run across sessions.

Installing or updating a persistent daemon is operationally related to providing the documented iPhone-control service, but direct execution of an unverified mutable script exceeds the minimum privilege and trust required to interact with the daemon's HTTP API. Persistence should be separately disclosed and approved, and installation should use a verifiable artifact.

Attack Path

  1. An attacker compromises the GitHub account, repository, branch, or another component capable of altering the content returned for install.sh.
  2. The attacker modifies the remote installer to include arbitrary malicious shell commands wh ...[truncated 1650 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh installation and update instruction.
  2. Publish versioned release artifacts and reference an immutable release tag or commit rather than the mutable main branch.
  3. Download the installer to a local file first so that its source and contents can be reviewed before execution.
  4. Publish a SHA-256 checksum through a separately protected channel and verify it before running the installer.
  5. Cryptographically sign release artifacts and verify the signature against a documented, trusted maintainer key. Prefer a signed and notarized macOS package.
  6. Require explicit user confirmation before installing a LaunchAgent. Clearly document its label, executable path, configuration, permissions, startup behavior, logs, network listeners, and uninstall procedure.
  7. Run the daemon with the least privileges necessary. Avoid administrator privileges, restrict filesystem access, bind locally by default, and protect the API with strong authentication.
  8. Separate daemon installation from routine Skill use. The Skill should normally interact only with an already installed and explicitly configured HTTP service.
  9. Pin updates to reviewed versions and provide rollback instructions rather than automatically following the repository's latest mutable state.
  10. Review and audit install.sh and every executable it retrieves before recommending it to users.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The documentation explicitly recommends curl ... | sh against a remote GitHub-hosted installer, which creates a direct arbitrary code execution path if the source, transport endpoint, repository, or upstream content is compromised. In the context of this skill, that risk is amplified because the tool controls a real iPhone and may hold tokens or access sensitive personal apps and data, so compromise of the host can cascade into device and account abuse.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

text
iphone-use 有新版本(latest,当前 version)。升级:
  daemon: curl -fsSL https://raw.githubusercontent.com/leeguooooo/iphone-use/main/install.sh | sh
  skill : npx skills update -g

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

(0,0 top-left, 1,1 bottom-right), so they're resolution-independent:

bash
curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"tap","x":0.5,"y":0.3}'
curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"tap","label":"新备忘录"}'  # (wda) tap BY ELEMENT — no coords
curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"scroll","x":0.5,"y":0.5,"dx":0,"dy":-60}'
curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"text","text":"Health"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"text","text":"Health"}' curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"key","name":"return"}' curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"shortcut","name":"home"}' # home|spotlight|switcher curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"longpress","x":0.4,"y":0.6}' # release with {"type":"up",...} curl -s -H "$AUTH" -X POST "$HOST/agent/input" -d '{"type":"keyboard"}' # (wda) dismiss the on-screen keyboard

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
the waits, and what you verified in each screenshot ("Health profile page:
   avatar top-right visible").
2. **When the task succeeds, freeze the log into a script** (bash or python:
   the curl sequence + sleeps). Normalized coordinates are stable for a given
   app screen + phone model, so replays are reliable.
3. **Keep checkpoints, drop reasoning.** At 2–3 key steps the script should
   grab a screenshot and do a cheap sanity check (or just save it for a human).

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The markdown instructs the agent to tell the user about updates using a Chinese message literal: "iphone-use 有新版本... 升级:". This imposes a specific language in user-facing communication without opt-in or documented locale scope, which is a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.