iOS still makes you tap through an “Allow Untrusted Shortcuts” warning before running anything you didn’t build yourself, but that warning never explains what the shortcut actually does. Trusty Trail closes that gap: it reads a shortcut’s actions before you install it and has AI translate them into a plain-language safety report.

What it does

Once you point Trusty Trail at a shortcut, it converts it into a property list, the format the Shortcuts app itself reads, and scans every action for suspicious behavior: deleting data, sending data to an outside server, silently changing device settings. Matches get sorted into twenty categories, each flagged red, orange, or yellow by risk.

Two AI models then write up what was found. Google’s Gemma drafts the explanation, and a pass through Cerebras’s GLM cleans up the wording before you see the finished report in a light or dark VCard-style menu.

What you’ll need

An internet connection: the AI step sends shortcut data out to Google’s and Cerebras’s APIs, so a check won’t finish offline.
A shortcut to check: pick one on your device, search inside Trusty Trail, or hand it a link from iCloud, RoutineHub, or a Reddit post.
“Allow Sharing Large Amounts of Data” turned on: under Settings > Apps > Shortcuts > Advanced, if asked.

Adding it to your iPhone

Tap Add Shortcut on this page to open Trusty Trail in the Shortcuts app.
Scroll the import preview down and tap Add Shortcut again to confirm.
Run it once and approve the permissions it asks for, including network access.
If a prompt for “Allow Sharing Large Amounts of Data” appears, turn it on under Settings > Apps > Shortcuts > Advanced.

First run

The main menu gives you three ways into a check:

Pick from your own list of installed shortcuts.
Search by a shortcut’s name.
Paste in a URL, whether it’s from iCloud, RoutineHub, or RoutineHub’s direct download page.

Importing also works from the Share Sheet. Share a Reddit post or comment with shortcut links inside, and Trusty Trail lists every one it finds, with name, icon, and poster attached.

Using it day-to-day

After a check finishes, Trusty Trail shows a verdict up top, safe or not, then a breakdown of every category where something matched. Tap into any category to read the AI’s explanation of what the action does and why it did or didn’t raise a flag. A clean result unlocks a “Generate a safety badge” button, saved as Markdown, an image link, or straight to Photos, and every badge carries details of which shortcut was verified so nobody can pass one off as their own.

Tips

Treat the AI verdict as a strong signal, not gospel. Language models occasionally get details wrong, so a “safe” result deserves a second look on anything touching your data.
Nuvole AI can freeze on launch. If the text field never shows up, close it and try again.
Very large shortcuts hit a size ceiling. Get close and the report warns the description might be off; go past it and that step gets skipped entirely.

Quick answers

Does Trusty Trail actually run the shortcuts I’m checking?

Not in the sense of executing them. It converts a shortcut into a Property List, the structured format the Shortcuts app reads internally, and checks which actions are present. That’s static analysis, not execution.

What happens if a shortcut is too big for the AI to check?

The suspicious-action list still comes through, since that part never depends on AI. What gets skipped, or flagged as possibly inaccurate, is the written explanation, so a huge shortcut still gets checked, just with a shorter report.

Can I trust a shortcut just because it has a safety badge?

Treat it as a reasonable signal, not a guarantee. A badge only gets generated after a live check that comes back safe, and it embeds details of which shortcut was verified so it can’t be reused elsewhere. The check underneath still runs on AI models, though, and those can misjudge intent like any automated scanner.