iOS 12 Untrusted Shortcuts Security Prompts

When running third-party or untrusted shortcuts in iOS 12, Apple enforces privacy protections through a series of context-based runtime security prompts. Rather than blocking shared files globally at the system level, iOS 12 intercepts sensitive shortcut actions dynamically to alert users before private data is accessed or external network requests are executed. This article outlines the specific prompts and warnings displayed when executing an untrusted shortcut on iOS 12.

Import and Action Preview

Before an untrusted shortcut runs, iOS 12 requires manual approval upon receiving the iCloud share link. The app opens a preview screen detailing every action included in the workflow. Users are presented with a "Get Shortcut" button alongside a full list of commands, giving the opportunity to inspect the script for malicious functions, such as unauthorized data transfers or hidden web requests, prior to adding it to the library.

System Data and Sensor Access Prompts

The first time a downloaded shortcut attempts to use device hardware or personal information, iOS 12 halts execution to display standard system-level permission dialogs. These modal alerts require explicit approval:

  • Media & Documents: "'Shortcuts' Would Like to Access Your Photos" or requests to access the Camera and Microphone.
  • Personal Data: Prompts requesting access to Contacts, Calendars, Reminders, and HealthKit metrics.
  • Device Services: Pop-ups seeking permission to use Location Services or access local network details.

Denying any of these prompts prevents the specific action from executing, causing the shortcut to pause or fail safely.

Network and URL Interaction Alerts

Untrusted shortcuts that scrape data, communicate with web APIs, or transmit payloads trigger network security dialogs. When an action such as "Get Contents of URL" runs, iOS 12 prompts:

  • Domain Access Confirmations: An alert asking whether to allow the shortcut to connect to a specific domain or IP address.
  • Data Transmission Notices: Warnings when a workflow attempts to send local file data, clipboard contents, or images to a remote server.

Script Execution Warnings

Shortcuts configured to run client-side code present explicit execution prompts to prevent unauthorized script evaluation:

  • JavaScript Execution: If a shortcut attempts to run JavaScript on an active Safari web page, a dialog warns the user and asks for permission to proceed.
  • SSH and Shell Commands: Any action that initiates a remote shell connection via SSH prompts for host confirmation and login credentials if they are not already permanently stored.

Communication and Action Confirmations

To mitigate spam and accidental data leaks, automated communication actions include confirmation safeguards. If a shortcut attempts to send an SMS via Messages, compose an email, or initiate a phone call, iOS 12 displays the outgoing message composition window or a confirmation prompt by default unless the creator explicitly toggled off "Show When Run," in which case initial privacy hurdles must still be cleared.