iPhone Malware Scan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate iPhone spyware scan, but it handles a full decrypted phone backup and backup password with weak containment, so it belongs in Review.

Install only if you are comfortable letting the skill install or upgrade scanning tools, create and decrypt a full iPhone backup, and store very sensitive phone data locally. Use a private local WORKDIR, avoid shared or cloud-synced folders, consider pinning/reviewing the MVT version before use, and delete backup/decrypted data after review with explicit confirmation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/01-preflight.sh:25

Finding

Unpinned Remote Dependency Installation and Automatic Upgrade

Content

View full analysis

/dev/null 2>&1; then c_ylw " upgrading mvt to latest ..." pipx upgrade mvt >/dev/null 2>&1 || pipx install mvt --force >/dev/null 2>&1 else c_ylw " installing mvt ..." pipx install mvt >/dev/null 2>&1 || die "failed to install mvt" fi ``` ### Technical Analysis The preflight script installs or upgrades MVT to the latest available package on every run. It does not pin an audited version, verify a package hash or signature, or require approval before replacing the installed version. This creates a remote payload retrieval and software supply-chain boundary: the code ultimately executed during backup decryption and scanning may differ from the code present when this Skill was audited. Because MVT processes a complete decrypted iPhone backup, a malicious package release would immediately receive access to exceptionally sensitive data. The dependency is installed from the expected package ecosystem and there is no evidence that the current MVT package is malicious. The risk arises from trusting all future releases and upstream distribution infrastructure without integrity controls. ### Attack Path 1. An attacker compromises the upstream MVT project, package publisher account, package registry, or relevant distribution infrastructure. 2. The attacker publishes a malicious release as the latest MVT version. 3. A user starts the assessment pipeline. 4. `01-preflight.sh` automatically executes `pipx upgrade mvt` or installs the package without pinning or integrity verification. 5. Later pipeline stages invoke the newly installed `mvt-ios` executable. 6. The compromised executable reads the decrypted iPhone backup and can access or transmit its contents usin ...[truncated 714 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run-all.sh:18

Finding

iPhone Backup Password Exposed Through Process Arguments

Content

View full analysis

&1 | grep -iE "enabled|already|error" | sed 's/^/ /' || true ``` From `scripts/04-decrypt.sh`: ```sh WORKDIR="${1:-$WORKDIR}" PASSWORD="${2:-${BACKUP_PASSWORD:-}}" [ -n "$PASSWORD" ] || die "no backup password (set BACKUP_PASSWORD or pass as arg 2)" step "Decrypting backup" mkdir -p "$DST" mvt-ios decrypt-backup -p "$PASSWORD" -d "$DST" "$SRC" 2>&1 | tail -3 | sed 's/^/ /' ``` From `scripts/run-all.sh`: ```sh : "${BACKUP_PASSWORD:?set BACKUP_PASSWORD to a password for the encrypted backup}" zsh "$HERE/03-backup.sh" "$WORKDIR" "$BACKUP_PASSWORD" || die "backup failed" zsh "$HERE/04-decrypt.sh" "$WORKDIR" "$BACKUP_PASSWORD" || die "decrypt failed" ``` ### Technical Analysis The orchestrator passes `BACKUP_PASSWORD` to child scripts as a positional argument. Those scripts then pass the same password as an argument to `idevicebackup2` and `mvt-ios`. Command-line arguments can be exposed through process-inspection and diagnostic facilities. The precise visibility depends on the macOS version, process ownership, and local security controls, but processes or users with sufficient process-inspection privileges may capture the password while these commands are running. Forwarding the password as a script argument also increases the number of process command lines in which the secret appears. The password is required for the declared encrypted-backup functionality. Its us ...[truncated 1399 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run-all.sh:13

Finding

Insufficient Access Controls for Decrypted Full-Device Data

Content

View full analysis

&1 | tail -3 | sed 's/^/ /' ``` From `scripts/05-scan.sh`: ```sh step "MVT check-backup (extract + heuristics + IOC match)" mkdir -p "$RES" mvt-ios check-backup --output "$RES" "$DEC" 2>&1 | tee "$RES/scan.log" \ ``` ### Technical Analysis The pipeline creates directories containing crash logs, an encrypted backup, a decrypted full-device backup, scan logs, and assessment results. It relies entirely on the caller's current `umask` and the permissions of any pre-existing `WORKDIR`. The scripts do not: - Set a restrictive `umask`, such as `077`. - Explicitly create sensitive directories with mode `0700`. - Verify that the workspace is owned by the invoking user. - Reject a workspace or output path that is a symbolic link. - Verify that an existing workspace is not writable by other users. On a typical system with a safe home directory and a conventional umask, practical exposure may be limited. Nevertheless, the Skill accepts an arbitrary `WORKDIR`, and its documentation encourages explicit selection of that directory. A shared, permissive, or attacker-prepared location can therefore expose or redirect highly sensitive output. ### Attack Path 1. A user selects a shared or permissively accessible `WORKDIR`, or an attacker prepares the ...[truncated 1440 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/03-backup.sh (reported line 5)May include surrounding context.

sh

# Step 3 — Create a FULL ENCRYPTED backup, auto-resuming on lock/disconnect.
#
# Encryption is required: an unencrypted iOS backup omits the databases MVT needs
# (keychain-adjacent data, health, more sqlite stores). We enable backup
# encryption with the supplied password.
#
# Usage: BACKUP_PASSWORD='secret' 03-backup.sh [workdir]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/07-assess.py (reported line 25)May include surrounding context.

python

KNOWN_DOMAIN_PREFIXES = (
    "AppDomain-", "AppDomainGroup-", "AppDomainPlugin-",
    "SysContainerDomain-", "SysSharedContainerDomain-",
    "KeychainDomain", "CameraRollDomain", "MediaDomain", "HomeDomain",
    "HomeKitDomain", "WirelessDomain", "InstallDomain", "DatabaseDomain",
    "TonesDomain", "BooksDomain", "ManagedPreferencesDomain", "RootDomain",
    "MobileDeviceDomain", "HealthDomain", "ProtectedDomain",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

## Cleanup

`WORKDIR/backup` and `WORKDIR/decrypted` hold the user's personal data and can be
very large. Offer to delete them when finished; never delete without asking.
The `mvt-results/` JSON is small and safe to keep for review.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/run-all.sh:5

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:71