A shortcut on your iPhone can read your contacts, your photos, your location and the files you hand it, because that is what Shortcuts is built to do.

A directory page that lists one, with a star rating and a “report this” button for “contains malicious code,” does not let you see what is actually inside it before you add it. Here is what to look at once you are past that page and iOS shows you the real thing.

Short answer

How to Check a Shortcut Is Safe Before Adding It on iPhone
  • Before you tap Add Shortcut, iOS shows you every action in the shortcut on one screen. Read it.
  • Apple’s own policy says it is not obligated to review shortcuts shared outside the Gallery, so no one checked it for you.
  • Look for what data each action touches (Contacts, your files, your location), not just what the shortcut claims to do by name.
  • This is not a Grabio safety verdict on any named shortcut. It is how to read one yourself.

What to check, in order

At a glance

Cost
Free, forever
Account
None needed
App Store
No install
Runs on
iPhone, via Shortcuts
What to check before you tap Add Shortcut, not after.
What to look at Why it matters Where you see it
The full list of actions, top to bottom A shortcut named “Battery Saver” can still contain a Get Contacts or Send Message action. The name is not a contract. The Add Shortcut screen that appears the moment you open a shared shortcut link, before you confirm anything
Which actions touch your data Apple flags the sensitive ones: location, contacts, health data, payment information, the contents of your documents Each action with a data-access icon or an “Ask Each Time” toggle, visible in the same review screen
Where it sends things, if anywhere An action that uploads a file or a photo to a web address is the one place a shortcut can actually leak something off your phone Look for Get Contents of URL, Upload, or similar networking actions in the list
Who published it and where A single creator you can trace beats an anonymous upload on a directory that does not vet submissions The share link itself, or the gallery listing it came from

What Apple actually says about this

Apple is direct about this in its own Shortcuts Sharing and Privacy notice, updated 12 Dec 2025 and read 5 Nov 2026: “Shortcuts that are downloaded from the web or shared with you by others may not have been reviewed by Apple, and Apple has no control over, and assumes no responsibility for, the content or functionality of those shortcuts.” The same page adds: “Apple has no obligation to review any shortcuts you share, although Apple may review, disable, or remove any shortcuts you share.”

In plain terms: a shortcut sitting on a directory site, including the ones with ratings and a malicious-code report form, has not necessarily been looked at by anyone at Apple. The rating is other users’ opinion, not a security check.

The same Apple page also says you “control which shortcuts access your personal data, such as your location (precise or approximate), contacts, health data, payment information, or the contents of your documents,” and that “you can review and control the data that a shortcut has access to in the details section for that shortcut.” That details section is the thing worth actually opening, every time, not just the first time.

Reading the Add Shortcut screen

When you open a shortcut someone sent you, whether through a link, AirDrop, or a file, iOS does not add it silently. It opens a review screen listing every action in order before anything runs or gets saved to your library.

Scroll the whole list once. If an action’s purpose does not match what the shortcut is supposed to do, that is the moment to stop, not after you have already tapped Add Shortcut and run it once.

Actions that touch something sensitive can carry an “Ask Each Time” option, which pauses the shortcut and asks you to approve that specific step on the specific run, rather than handing blanket access forever. Turning that on for anything involving your files, contacts or location costs you one extra tap per run and buys you a second look every time.

What this means for a site like ShortcutsGallery

A directory built around scale, one page template across thousands of shortcuts, a star rating, and a report form listing “Duplicate, Not working, Contains malicious code, Broken link” as the four reasons, gives you none of this before you download.

The report form existing at all is itself an admission that the site expects some submissions to be bad.

The actions list only shows up once you leave that page and open the shortcut in the Shortcuts app itself, which is exactly why it is worth treating as a separate, mandatory step rather than an optional one.

Grabio is a single shortcut, not a directory, and anyone can open it in the Shortcuts app and read every action the same way before adding it. That openness is worth something specifically because it means you are not trusting a rating, you are reading the thing.

If you came here from turning the device setting on rather than reading a shortcut’s contents, Allow Untrusted Shortcuts on iPhone covers that setting step by step. For a broader look at one particular directory, see the Shortcuts Gallery on iPhone, and for one specific borrowed shortcut, the R Download Shortcut alternative.

Get Grabio, free

A single Shortcut for your iPhone share sheet, with every action readable in the Shortcuts app. No account.

Get the free Shortcut

Checking a shortcut before adding it: FAQ

Does Apple check every shortcut on a gallery site before it is listed?

No. Apple’s own Shortcuts Sharing and Privacy page says shortcuts downloaded from the web or shared by others may not have been reviewed by Apple, and that Apple assumes no responsibility for their content or functionality.

Where do I actually see what a shortcut does before adding it?

On the Add Shortcut screen that opens when you tap a shared shortcut link. It lists every action in order. Read that list before you tap Add Shortcut, not after.

What is the single riskiest kind of action to watch for?

Anything that sends data off your phone, actions like Get Contents of URL or an upload step, paired with an action that reads something sensitive first (Contacts, your files, your location).

What does “Ask Each Time” do?

It is a per-action option for sensitive data access. Turning it on means the shortcut pauses and asks your permission on every run for that specific action, instead of running silently once you have approved it the first time.

Is a high star rating on a shortcut directory a safety signal?

It is a popularity signal, not a security check. The directory’s own report form for “Contains malicious code” is there because ratings do not catch that.

Does Grabio ask for anything sensitive?

Check the same way: open Grabio in the Shortcuts app and read its actions, the same advice this page gives for any shortcut. That is the point of writing this rather than asking you to take a brand’s word for it.