Agent skill · Audited from source

Ios Simulator Skill

skill · conorluddy/ios-simulator-skillMIT licenceAudited 14 Oct 2026 · source 849dde0b2204

★ 1,277pushed 8 days agoversion 1.5.0
✕BLOCKGrade D · 69/100 · 11 findings · 849dde0
1,277repo stars · whole conorluddy/ios-simulator-skill

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 849dde0b2204 and observed filesystem and network access and no hard-coded secrets. The audit raised 11 findings, 5 critical or high. What it does: 29 production-ready scripts for iOS app testing, building, and automation. Provides semantic UI navigation, build automation, accessibility testing, and simulator lifecycle management. Optimized for AI agents with…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Ios Simulator Skill (conorluddy/ios-simulator-skill)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/conorluddy/ios-simulator-skill

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 5 critical or high findings, starting with “Network egress” in skills/ios-simulator-skill/scripts/simctl_erase.py:148. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 14 Oct 2026

Trust score69/100✕BLOCK D
0 critical5 high5 medium0 low1 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemUndeclared2 observations, not in its own description
  • NetworkDeclared5 observations
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL10
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (11)

HIGHNetwork egressnet.tls_off · skills/ios-simulator-skill/scripts/simctl_erase.py:148
F-04 Network egressCWE-200 · CWE-319Layer L1
success, _message = eraser.erase(verify=False)
Why
certificate verification is disabled
Fix
leave verification on
HIGHNetwork egressnet.tls_off · skills/ios-simulator-skill/scripts/simctl_erase.py:174
F-04 Network egressCWE-200 · CWE-319Layer L1
success, _message = eraser.erase(verify=False)
Why
certificate verification is disabled
Fix
leave verification on
HIGHNetwork egressnet.tls_off · skills/ios-simulator-skill/scripts/simctl_erase.py:196
F-04 Network egressCWE-200 · CWE-319Layer L1
success, _message = eraser.erase(verify=False)
Why
certificate verification is disabled
Fix
leave verification on
HIGHNetwork egressnet.tls_off · skills/ios-simulator-skill/scripts/simctl_shutdown.py:133
F-04 Network egressCWE-200 · CWE-319Layer L1
success, _message = shutdown.shutdown(verify=False)
Why
certificate verification is disabled
Fix
leave verification on
HIGHNetwork egressnet.tls_off · skills/ios-simulator-skill/scripts/simctl_shutdown.py:159
F-04 Network egressCWE-200 · CWE-319Layer L1
success, _message = shutdown.shutdown(verify=False)
Why
certificate verification is disabled
Fix
leave verification on
MEDIUMFilesystem / pathfs.destructive · skills/ios-simulator-skill/scripts/xcode/cache.py:96
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(dest_path)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.destructive · skills/ios-simulator-skill/scripts/xcode/cache.py:154
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(bundle_path)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrivilege escalation / persistencefs.persistence · skills/ios-simulator-skill/scripts/app_launcher.py:216
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
cmd = build_simctl_command("spawn", self.udid, "launchctl", "list")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrivilege escalation / persistencefs.persistence · skills/ios-simulator-skill/scripts/simctl_boot.py:119
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
["xcrun", "simctl", "spawn", self.udid, "launchctl", "list"],
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrivilege escalation / persistencefs.persistence · skills/ios-simulator-skill/scripts/simctl_erase.py:110
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
["xcrun", "simctl", "spawn", self.udid, "launchctl", "list"],
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionscope.undeclared_system · <declared scope>
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
system use found in code, not declared in the description
Why
the description does not admit a capability the code has
Fix
declare system use in the description, or remove it

Audit 0.4.1 · source sha 849dde0b2204 · 14 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherconorluddy GitHub userOwner of the repository this skill is read from
  • Source folderconorluddy/ios-simulator-skill/ios-simulator-skillThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict849dde0b2204A new audit runs when the source changes
  • Repository statusNot archivedLast push 8 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: 29 production-ready scripts for iOS app testing, building, and automation. Provides semantic UI navigation, build automation, accessibility testing, and simulator lifecycle management. Optimized for AI agents with…

---
name: ios-simulator-skill
version: 1.5.0
description: 29 production-ready scripts for iOS app testing, building, and automation. Provides semantic UI navigation, build automation, accessibility testing, and simulator lifecycle management. Optimized for AI agents with minimal token output.
---

# iOS Simulator Skill

Build, test, and automate iOS applications using accessibility-driven navigation and structured data instead of pixel coordinates.

## Quick Start

```bash
# 1. Check environment
bash scripts/sim_health_check.sh

# 2. Launch app
python scripts/app_launcher.py --launch com.example.app

# 3. Map screen to see elements
python scripts/screen_mapper.py

# 4. Tap button
python scripts/navigator.py --find-text "Login" --tap

# 5. Enter text
python scripts/navigator.py --find-type TextField --enter-text "[email protected]"
```

All scripts support `--help` for detailed options and `--json` for machine-readable output.

## Navigation Strategy

**Always prefer the accessibility tree over screenshots for navigation.** The accessibility tree gives you element types, labels, frames, and tap targets — structured data that's cheaper and more reliable than image analysis.

Use this priority:
1. `screen_mapper.py` → structured element list (5-7 lines, ~10 tokens)
2. `navigator.py --find-text/--find-type/--find-id` → semantic interaction
3. Screenshots → only for visual verification, bug reports, or visual diff

Screenshots cost 1,600–6,300 tokens depending on size. The accessibility tree costs 10–50 tokens in default mode.

## 29 Production Scripts

### Build & Development (2 scripts)

1. **build_and_test.py** - Build Xcode projects, run tests, parse results with progressive disclosure
   - Build with live result streaming
   - Parse errors and warnings from xcresult bundles
   - Retrieve detailed build logs on demand
   - Options: `--project`, `--scheme`, `--clean`, `--test`, `--verbose`, `--json`

2. **log_monitor.py** - Real-time log monitoring with intelligent filtering
   - Stream logs or capture by duration
   - Filter by severity (error/warning/info/debug)
   - Deduplicate repeated messages
   - Options: `--app`, `--severity`, `--follow`, `--duration`, `--output`, `--json`

### Device State (2 scripts)

3. **appearance.py** - Control simulator appearance: dark mode, Dynamic Type size, and locale/region
   - Toggle light/dark theme via `xcrun simctl ui`
   - Set Dynamic Type size with friendly aliases (XS through AX5)
   - Write locale and region defaults; optional app restart via `--bundle-id`
   - RTL flagged automatically for ar/he/fa/ur/yi locales
   - Options: `--theme`, `--text-size`, `--locale`, `--region`, `--reset`, `--bundle-id`, `--udid`, `--json`, `--verbose`

4. **location.py** - Simulate GPS coordinates, named city presets, and GPX scenario playback
   - Fix a coordinate with `--lat`/`--lng` or pick a city with `--city`
   - Play a built-in scenario (City Run, Freeway Drive, etc.) via `--gpx <scenario>`
   - Animate multi-waypoint paths with configurable speed via `--waypoints` and `--speed`
   - Clear simulated location with `--clear`; list available scenarios with `--list-scenarios`
   - Options: `--lat`, `--lng`, `--city`, `--gpx`, `--waypoints`, `--speed`, `--clear`, `--list-scenarios`, `--udid`, `--json`, `--verbose`

### Navigation & Interaction (5 scripts)

5. **screen_mapper.py** - Analyze current screen and list interactive elements
   - Element type breakdown
   - Interactive button list
   - Text field status
   - Options: `--verbose`, `--hints`, `--json`

6. **navigator.py** - Find and interact with elements semantically
   - Find by text (fuzzy matching)
   - Find by element type
   - Find by accessibility ID
   - Enter text or tap elements
   - Options: `--find-text`, `--find-type`, `--find-id`, `--tap`, `--enter-text`, `--json`

7. **gesture.py** - Perform swipes, scrolls, pinches, and complex gestures
   - Directional swipes (up/down/left/right)
   - Multi-swipe scrolling
   - Pinch zoom
   - Long press
   - Pull to refresh
   - Options: `--swipe`, `--scroll`, `--pinch`, `--long-press`, `--refresh`, `--json`

8. **keyboard.py** - Text input and hardware button control
   - Type text (fast or slow)
   - Special keys (return, delete, tab, space, arrows)
   - Hardware buttons (home, lock, volume, screenshot)
   - Key combinations
   - Options: `--type`, `--key`, `--button`, `--slow`, `--clear`, `--dismiss`, `--json`

9. **app_launcher.py** - App lifecycle management
   - Launch apps by bundle ID
   - Terminate apps
   - Install/uninstall from .app bundles
   - Deep link navigation
   - List installed apps
   - Check app state
   - Pass launch arguments (`--args`) and environment variables (`--env KEY=VALUE`, injected as `SIMCTL_CHILD_*`) to the app on launch/restart
   - Options: `--launch`, `--terminate`, `--restart`, `--install`, `--uninstall`, `--open-url`, `--list`, `--state`, `--args`, `--env`, `--wait-for-debugger`

### Testing & Analysis (9 scripts)

10. **accessibility_audit.py** - Check WCAG compliance on current screen
    - Critical issues (missing labels, empty buttons, no alt text)
    - Warnings (missing hints, small touch targets)
    - Info (missing IDs, deep nesting)
    - Options: `--verbose`, `--output`, `--json`

11. **visual_diff.py** - Compare two screenshots for visual changes
    - Pixel-by-pixel comparison
    - Threshold-based pass/fail
    - Generate diff images
    - Options: `--threshold`, `--output`, `--details`, `--json`

12. **test_recorder.py** - Automatically document test execution
    - Capture screenshots and accessibility trees per step
    - Generate markdown reports with timing data
    - Options: `--test-name`, `--output`, `--verbose`, `--json`

13. **app_state_capture.py** - Create comprehensive debugging snapshots
    - Screenshot, UI hierarchy, app logs, device info
    - Markdown summary for bug reports
    - Options: `--app-bundle-id`, `--output`, `--log-lines`, `--json`

14. **sim_health_check.sh** - Verify env

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 849dde0

git clone https://github.com/conorluddy/ios-simulator-skill
git -C ios-simulator-skill checkout 849dde0b2204

The author documents no install command, so this uses the repository directly. Our verdict covers commit 849dde0b2204 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 849dde0b2204

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/conorluddy/ios-simulator-skill/badge.svg)](https://modelsatlas.com/skills/conorluddy/ios-simulator-skill/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/conorluddy/ios-simulator-skill/badge.svg)](https://modelsatlas.com/skills/conorluddy/ios-simulator-skill/)

Questions about Ios Simulator Skill

What does the Ios Simulator Skill skill do?
An IOS Simulator Skill for Agents. Use it to optimise their ability to build, run and interact with your apps, and to proxy xcodebuild to save token and context wastage.
Is Ios Simulator Skill safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can Ios Simulator Skill access on my machine?
The audit observed that it reaches the network and reads or writes files. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.
Which assistants does Ios Simulator Skill work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (849dde0b2204), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.