audit_ios_privacy
Analyzes iOS and React Native app configurations and source code to detect privacy issues like missing usage descriptions, unused permissions, bundled secrets, and undisclosed data egress, aiding App Review compliance.
Instructions
Audit an iOS or React Native/Expo app's privacy posture for App Review and user trust. Reads a native Info.plist XML OR an Expo app.json (managed Expo apps have no Info.plist) — plus optional PRIVACY.md, entitlements, and source. Flags: NS*UsageDescription strings that are vague/missing or contradict the code (e.g. a HealthKit write claim the code never fulfills), entitlements/permissions and Android permissions the app doesn't use, ATS cleartext exceptions and non-HTTPS endpoints, secrets/keys shipped in the bundle or app.json, and default data-egress paths not disclosed at the point of choice (a pre-selected 'Recommended' option that silently sends personal data to a server). Same return shape as audit_page.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Optional concatenated source (Swift or JS/TS) — enables code-vs-declaration contradiction checks and default-egress detection | |
| app_json | No | Expo app.json / app.config JSON (managed RN). Its expo.ios.infoPlist, expo.android.permissions, plugins, and extra are audited. | |
| info_plist | No | Raw Info.plist XML (native iOS / bare RN). Provide this OR app_json. | |
| privacy_md | No | Optional PRIVACY.md / privacy policy text to cross-reference against declared permissions and default behavior | |
| entitlements | No | Optional .entitlements XML |