Midscene Automations Skills for iOS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:50 PM UTC
• Version: 1.0.5

Overview

This iOS automation skill is coherent, but it should be reviewed carefully because it can control a real device, process screenshots with external AI providers, and runs mutable npm packages without tight safeguards.

Install only if you intend to let an agent operate a connected iPhone or iPad. Use a test device or test account when possible, avoid sensitive screens unless necessary, review screenshots and reports before sharing them, keep only the required model API key available to the process, and prefer pinned, reviewed Midscene package versions instead of automatic latest-range installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Mutable Third-Party npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:26, SKILL.md:84-164, SKILL.md:190-198, and SKILL.md:226
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

Automate iOS devices using `npx -y @midscene/ios@1`.

Representative commands used throughout the skill include:

bash

npx -y @midscene/ios@1 connect
npx -y @midscene/ios@1 runwdarequest --method GET --endpoint /wda/screen
npx -y @midscene/ios@1 take_screenshot
npx -y @midscene/ios@1 act --prompt "type hello world in the search field and press Enter"
npx -y @midscene/ios@1 assert --prompt "there is a login button visible"
npx -y @midscene/ios@1 disconnect
npx -y @midscene/ios@1 report-tool --action to-markdown --htmlPath ./midscene_run/report/.../index.html --outputDir ./output-markdown

The troubleshooting guidance also recommends installing mutable latest releases:

bash

npm i @midscene/ios@latest @midscene/core@latest @midscene/shared@latest

Technical Analysis

The skill repeatedly directs the agent to invoke npx with the -y option. This option automatically accepts package installation, allowing code obtained from the npm registry to be executed without an interactive confirmation step.

The dependency selector @midscene/ios@1 pins only the major version rather than an exact audited release. It can therefore resolve to different version 1.x releases over time. The recommendation to install packages using @latest is even less constrained and can resolve to any release currently associated with the mutable npm distribution tag.

The audited project contains only SKILL.md; it provides no lockfile, integrity hashes, vendored dependency code, package-signature validation, or other mechanism that binds execution to a previously reviewed artifact. Consequently, the effective code executed by these instructions can change after the skill itself has been reviewed.

This is a supply-chain weakness rather than ev ...[truncated 2073 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable dependency selectors with exact, reviewed versions:

   bash

   npx -y @midscene/ios@1.2.3 connect
   

   The actual version should be selected only after review; the example version above is illustrative.

2. Prefer installing dependencies in advance with a committed lockfile rather than downloading them at each invocation:

   bash

   npm ci
   ./node_modules/.bin/midscene-ios connect
   

3. Commit package.json and package-lock.json, and require lockfile integrity verification in deployment and CI workflows.

4. Remove the recommendation to install @latest. Upgrades should use an exact proposed version and require dependency review, changelog inspection, and security testing before adoption.

5. Where operationally compatible, install dependencies with lifecycle scripts disabled:

   bash

   npm ci --ignore-scripts
   

   If lifecycle scripts are required, review them explicitly before permitting execution.

6. Run the automation package in a restricted environment with least-privilege filesystem access, minimal environment variables, constrained outbound network access, and no unrelated credentials.

7. Keep API credentials outside the project directory and expose only the credentials required for the current run. Rotate credentials if dependency compromise is suspected.

8. Add package provenance, registry allowlisting, checksum verification, and dependency vulnerability scanning to the package-approval process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explains that screenshots are analyzed by external model providers and lists third-party API configuration, but it does not clearly warn users that on-screen contents may be transmitted off-device. Since the skill operates entirely from screenshots and may capture messages, credentials, personal data, or enterprise app data, users may unknowingly expose sensitive information to external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is excessively broad and includes generic phrases like 'swipe', 'ios', and 'iphone automation', which can cause the skill to activate for loosely related requests. Because this skill can drive a real device and perform actions through screenshots, accidental invocation increases the chance of unintended or destructive device interactions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions require the agent to proactively summarize key data found and screenshots taken, which encourages over-disclosure by default. In a screenshot-driven device automation context, that can expose sensitive on-screen content, personal information, tokens, messages, or app data beyond what the user actually asked for.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill can tap, type, long-press, navigate system UI, open links, and perform multi-step actions, but it does not clearly warn that these actions may be destructive or irreversible. In practice, a natural-language prompt could trigger settings changes, purchases, message sends, deletions, or other device-affecting operations without adequate caution to the user.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow and best-practice sections direct the agent to present extracted data, logs, and generated file paths automatically after task completion. This creates a built-in leakage pattern where screenshots, report files, and observed device data may be surfaced even when unnecessary, increasing the chance of disclosing confidential or personal information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The troubleshooting section directs users to a /zh/ documentation URL, which may force a specific language experience without user opt-in. The file does not explain that the Chinese page is intentional or provide an alternative language-neutral link.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.