Skip to content
Get packs

Competition iOS Runtime

Guides an agent through hooking and tracing a CTF iOS app's runtime behavior, inside an orchestrator-led sandbox workflow.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This is a specialist playbook that tells an AI agent how to analyse an iOS app (an IPA file) while it runs, for capture-the-flag style security competitions. It directs the agent to inspect app metadata and Keychain storage, hook Objective-C or Swift methods, look at how requests are signed, bypass SSL pinning, and replay an accepted request. It is designed as a downstream skill that only activates after a parent skill, ctf-sandbox-orchestrator, has set the sandbox rules and scope.

Great for

  • Security competitors working on iOS reverse-engineering challenges in an authorised CTF sandbox
  • Security researchers analysing their own test apps in an isolated lab environment

Skip it if

  • Analysing real third-party apps or production services without authorisation, since the skill focuses on bypassing pinning and replaying signed requests
  • Users who have not set up the parent ctf-sandbox-orchestrator skill, because the file says this skill should not be used first

Try asking

  • “Hook the request signer in this IPA and show me the signed string and headers it produces”
  • “Trace the Objective-C selectors that read the Keychain during login in this CTF app”
  • “Bypass SSL pinning in the sandbox build so I can see the real API request”
  • “Map the URL schemes and universal links in this bundle's Info.plist”
Step-by-step guide: how to use Competition iOS RuntimeInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-ios-runtime.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-ios-runtime.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-ios-runtime.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run this only inside the sandbox defined by ctf-sandbox-orchestrator, with the parent skill active first
  • Ask for the narrowest hook possible (one signer or one Keychain read) rather than broad tracing of the whole app
  • Keep the original IPA and any re-signed copies separate, as the skill instructs, so results stay reproducible

What's inside

  • agents/openai.yaml
  • references/ios-runtime.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.