ios-debug

PassAudited by ClawScan on May 13, 2026.

Overview

This is a coherent iOS debugging instruction skill, but it can run commands that control a connected iPhone app and capture local logs or screenshots.

Use this only on a trusted macOS development machine with the intended iPhone connected. Check the fixed device IDs and all placeholders before running commands, approve uninstall/provisioning actions explicitly, stop background log streams when done, and avoid capturing sensitive phone screens or logs unless you intend to review them locally.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken device ID or bundle ID could stop or remove the wrong app, potentially deleting that app's local data.

Why it was flagged

These commands can install, launch, terminate, or uninstall an app on a connected iPhone. That is central to the debugging purpose and is disclosed, but it can affect app state or data if run against the wrong bundle.

Skill content
xcrun devicectl device install app ... "$APP_PATH"; xcrun devicectl device process launch ... --terminate-existing <bundle_id>; xcrun devicectl device uninstall app ... <bundle_id>
Recommendation

Verify the device ID, bundle ID, project, and scheme before running install, launch, terminate, or uninstall commands; ask for explicit user approval before uninstalling.

What this means

The build may trigger signing or provisioning changes tied to the user's Apple Developer setup.

Why it was flagged

The Xcode provisioning flag can use the locally signed-in Apple Developer account or signing assets to manage provisioning. This is expected for iOS device builds, but it is a privileged account-related action.

Skill content
xcodebuild ... -allowProvisioningUpdates build
Recommendation

Use this only with the intended Apple Developer account and remove the provisioning-update flag if automatic signing changes are not desired.

What this means

The skill may fail or cause confusing command attempts on systems that do not have the expected Apple developer tooling.

Why it was flagged

The registry metadata does not declare the macOS/Xcode/QuickTime/libimobiledevice prerequisites that the SKILL.md commands rely on. This is an under-declared environment requirement, not hidden code.

Skill content
Required binaries (all must exist): none ... OS restriction: none
Recommendation

Declare the macOS restriction and required tools such as xcrun/xcodebuild, QuickTime, screencapture/osascript, and idevicesyslog.

What this means

A background debug process may continue streaming logs or keep the app session tied to the terminal until it is killed.

Why it was flagged

The skill explicitly recommends running the console log command in the background and killing it later. This is disclosed and purpose-aligned for live logs, but it can linger if not stopped.

Skill content
这是阻塞命令,用 `control_bash_process` 后台启动 ... 退出时 kill 进程即可
Recommendation

Track the background process and stop it after debugging is complete.