domains / families / security / ios-redteam-pipeline

ios-redteam-pipeline

authentic

End-to-end iOS red-team pipeline

When to use

Recon surfaces 1+ apps under the target's Apple Developer / App Store publisher page
A TestFlight public link or enterprise/ad-hoc `.ipa`/`manifest.plist` (OTA install) is found
Customer-facing app, dealer/partner portal, or employee mobile companion app ships on iOS
Bug bounty program lists iOS in scope
`apk-redteam-pipeline` already found Android endpoints/secrets — the iOS build often ships a *different* backend version worth diffing (see `hunt-shadow-api`)
Android-only targets — that's `apk-redteam-pipeline`
React Native / Flutter apps already fully covered by JS-bundle analysis on the web side
Server-side only assessments with no mobile client in scope

Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Repository	Path
sickn33/agentic-awesome-skills	`plugins/agentic-awesome-skills-claude/skills/ios-redteam-pipeline/SKILL.md`