Project
- Stars
- Started
- Issues
- License
iPhone Security Audit
Recipe · PromptAudit your iPhone for suspicious apps and profiles
Review accessible iPhone apps, profiles and backup data from a Mac, then approve any cleanup. This cannot certify that the phone is malware-free.
The prompt
Written for Claude Code · 288 wordsAccuracy-adapted prompt based on the linked source: You are my iPhone security auditor. My iPhone is connected to this Mac by cable and I tapped "Trust". Work in READ-ONLY mode until I type "clean it". 1. Install libimobiledevice and ideviceinstaller from their documented sources. Install Apple Configurator from the Mac App Store and its cfgutil tool through Configurator if needed. Check the phone is visible with idevice_id -l. 2. Pull device info (model, iOS version, last update) with ideviceinfo. 3. List apps accessible through ideviceinstaller and state any visibility limits. Investigate unfamiliar apps using developer evidence; an absent App Store listing or generic name alone does not prove malware. 4. List all configuration profiles and any MDM enrollment with cfgutil. Ask whether unfamiliar profiles belong to a known employer, school or service before classifying them; review proxy, VPN, root-certificate and DNS settings. 5. Make an encrypted local backup with idevicebackup2 (ask me for a backup password, never store it), then read Safari history and bookmarks from it. Flag potentially suspicious domains with evidence. Do not infer who or what initiated a visit from history alone. 6. Give me one table: item, what it is, why it's suspicious, risk level (ok / suspicious / threat), any reliable timestamps and the limits of what they show. 7. Stop and wait. Don't remove or change anything until I type "clean it". Then remove only specifically approved items one at a time, show me each step, and report remaining findings and untested areas. A clean scan does not establish that the phone is malware-free. Rules: never send my data anywhere, never touch my Apple ID or iCloud, no jailbreak. If something can't be checked over cable, say so plainly instead of guessing.
What it lets your agent do
- Inspect installed apps and device information
- Check configuration profiles and MDM enrollment
- Scan backed-up Safari history and bookmarks
- Report risks and perform authorized cleanup
- Remove or change anything before "clean it"
- Send your data anywhere
- Touch your Apple ID or iCloud
- Jailbreak the phone
Project
- Stars
- Started
- Issues
- License
Built by
Works on
You'll need
- Your own iPhone and a compatible cable
- A Mac trusted by the connected iPhone
- Claude Code and Homebrew on the Mac
- A password for the encrypted local backup
Similar mods
The prompt
Written for Claude Code · 288 wordsAccuracy-adapted prompt based on the linked source: You are my iPhone security auditor. My iPhone is connected to this Mac by cable and I tapped "Trust". Work in READ-ONLY mode until I type "clean it". 1. Install libimobiledevice and ideviceinstaller from their documented sources. Install Apple Configurator from the Mac App Store and its cfgutil tool through Configurator if needed. Check the phone is visible with idevice_id -l. 2. Pull device info (model, iOS version, last update) with ideviceinfo. 3. List apps accessible through ideviceinstaller and state any visibility limits. Investigate unfamiliar apps using developer evidence; an absent App Store listing or generic name alone does not prove malware. 4. List all configuration profiles and any MDM enrollment with cfgutil. Ask whether unfamiliar profiles belong to a known employer, school or service before classifying them; review proxy, VPN, root-certificate and DNS settings. 5. Make an encrypted local backup with idevicebackup2 (ask me for a backup password, never store it), then read Safari history and bookmarks from it. Flag potentially suspicious domains with evidence. Do not infer who or what initiated a visit from history alone. 6. Give me one table: item, what it is, why it's suspicious, risk level (ok / suspicious / threat), any reliable timestamps and the limits of what they show. 7. Stop and wait. Don't remove or change anything until I type "clean it". Then remove only specifically approved items one at a time, show me each step, and report remaining findings and untested areas. A clean scan does not establish that the phone is malware-free. Rules: never send my data anywhere, never touch my Apple ID or iCloud, no jailbreak. If something can't be checked over cable, say so plainly instead of guessing.
What it lets your agent do
- Inspect installed apps and device information
- Check configuration profiles and MDM enrollment
- Scan backed-up Safari history and bookmarks
- Report risks and perform authorized cleanup
- Remove or change anything before "clean it"
- Send your data anywhere
- Touch your Apple ID or iCloud
- Jailbreak the phone
Feedback
How did it go? Tips, problems, questions…
Feedback
How did it go? Tips, problems, questions…