What is "ShortcutsActions" and why is it accessing contacts on my iPhone?

Ruckles wrote:

Apple’s About App Privacy Report page details every app that accesses contact data. Shortcuts isn’t mentioned. 

The mistake you are making is that you think ShortcutActions is an App and is the same thing as the Shortcut App. It is NOT. ShortcutActions operates under the App Intent Framework. These are "hooks" built into the apps to perform some function that can be called by another App or the System. Developers can create their own App Intents to perform a function by using Siri, add an action in the Shortcut App, or fetch some data from the app for use in a Widget.

App Intents | Apple Developer Documentation

In your screenshot of Messsages having access to your Contact Info, guess how it gets that information. If you said a ShortcutAction you would be correct. Messages is not launching the Shortcut App to get this information, it is using an App Intent built into the Contacts app to get it. You also cannot tell Messages that you do not want to give it access to your Contacts so you will not be preventing ShortcutActions from being used when Messages wants to know what name is associated with the number that just sent you a message.

Another thing you fail to realize is that even though the Shortcut app does not show that it has access to the Contacts in the Privacy Page, the Shortcut app can certainly be used to access Contacts. One of the publicly available actions to the Contacts app in the Shortcut app is called "Add New Contact", where it can take a First Name, Last Name, or Company Name as input and when run a new contact will be added to the Contacts app.

foxowl wrote:

Thank you for this that makes sense. But what if you have implicitly not given any app to access your contacts? And the ShortcutsActions app is still doing the same thing? Exactly as described by the OP

Do you have an example of an app as the OP shows it for Contacts? You can only revoke permission for third party apps and cannot stop the Phone/Mail/Messages apps from accessing Contacts.

And also, it is my belief that ShortcutsActions showing in the App Privacy Report is a bug. It is not an app at all and is a process that runs in the background on the OS, where it may not even be related to an app. That is apparent by the default icon showing. We have seen these same types of processes with the same icon appearing in Screen Time where they were later removed following an update. You can send feedback to Apple here and one of the options is for a Bug Report.

Feedback - iPhone - Apple

Today’s iOS 18.7 release includes a security fix for CVE-2025-43358, a vulnerability that allowed malicious shortcuts to bypass sandbox restrictions—meaning it could be exploited by malware to gain unauthorized access to sensitive data.

Probably a good idea to run the update. 

Carking2013 wrote:

That would make sense if I had the shortcuts app installed on my iPhone but I do not. I uninstalled that the second I got the phone. And I’ve had the phone for months. And according to my find my, my iPhone is the only phone connected to my iCloud account.

Go to the last page of your Home screen, the App Library, and look for Shortcuts. I suspect it is still there; you only removed it from your Home screen, not from the iPhone.

You, or someone you share the phone or an Apple ID with, has created a shortcut.

Use the Shortcuts app on your iPhone or iPad - Apple Support

Shortcuts User Guide - Apple Support

Apps that interface with the outside world are the only ones that you need to be concerned about regarding data privacy. Internal processes like Shortcuts and associated sub-processes like shortcutsactions do not interface with the outside world.

Dear Touch7

The shortcuts actions isn’t triggered by the shortcuts app. The shortcut actions you see in the log are triggered because of the contacts you see when you share something, and the menu comes up, where you have “shortcuts” for your contacts etc.

Greetings Wayne

Yes, iOS apps talk to each other. But Shortcuts doesn’t handle contact data in iOS unless someone specifically created a workflow doing so. And, if the shortcut is legit, you can view and control its data access.

So if the App Privacy Report says an obscured, unactionable workflow is suddenly accessing contact data—for some users only, on devices where it’s not installed, no shortcuts were created, and timestamps can’t be correlated to user actions—that’s the issue.

The report’s there so that, “if an app appears to be accessing your data in a way or at a time that you didn't expect, you can update your privacy settings or revoke permission.”

Shortcutsactions isn’t an app and this can’t be updated, so its inclusion is, at the very least, a bug. Without evidence to the contrary, it might also be malware. 

Automation is inherently risky (Apple’s words, not mine), and they advise to, “review all shortcuts downloaded from the web or shared with you with extra caution to confirm that they function as you expect.”

Just last year, Shortcuts had a critical, zero-click exploit that allowed hackers to access sensitive data.

This also showed up without user interaction; of course people should try and validate that it’s not malicious. That’s not a conspiracy theory, it’s common sense. 

I was able to get it by making a shortcut in shortcuts app. Do you have a shortcut that uses contacts?

Shel7585 wrote:

I had the same issue. (I posted a question yesterday no one responded too yet). I noticed shortcut actions on my App Privacy Report and did have the short cut app deleted right when I got the phone too. I don’t use it. I have a screenshot showing the shortcut actions ghost icon recently being used….I THEN AFTER downloaded the ShortCut App from the App Store and it was toggling on for “saved to iCloud’ in settings. and when u go to Apps in settings it was toggled on for ‘iCloud sync’. The shortcut app had some already pre set up shortcuts such as duck duck go VPN (which I don’t have), Wells Fargo, check in, outlook, tik tok, Amazon, clock, newsbreak, music recognition.

I don't see any problem there.

If you are waiting here you will wait forever in this user-to-user forum. But if you go back and read the 4 pages in the thread that you added to you will be enlightened.

Hello everyone

no expert on this specific topic or ios related security but due to my general experience with other security related incidents i would recommend those wo are affected or interested or concerned these steps:

1. Look in the files App, there is maybe local on your IPhone or in the cloud a shortcuts folder that could contain files related with your problem. (That doesn’t mean there is a virus.shortcut file but maybe some old stuff you forgot about that explains the behavior)
2. Check if the shortcuts app also shows up on your battery usage and or screen time.
3. if it is possible for you (you don’t have to be an expert but you should have some experience in the field)keep an eye on the network traffic of the device in your wifi network, maybe you can find some suspicious activity or addresses in the traffic. But no guarantee here either.
4. don’t listen to me and don’t freak out, give the real experts time to do there job.And remember just because it could be doesn't mean it is.

greetings Wayne

As I’ve explained several times, this will be the last. The Shortcuts app has a large number of built in shortcuts. Many of the need access to contacts.

But the key fact is that ALL OF THESE INTERACTIONS ARE BETWEEN APPS ON YOUR DEVICE, AND NEVER LEAVE THE DEVICE, SO THERE IS NO VULNERABILITY OR SECURITY PROBLEM. What is so hard to understand about this FACT?!

I’m really sick of this thread, and I will stop following it. Have a nice rest of your life.

Hello again

As i wrote a long long time ago, shortcuts actions are the shortcut symbols on your share sheet (i didn’t explain it explicitly but i thought the context would be enough to understand what i meant. Sorry for that). Share some fotos or whatever you like and look on the clock. You will see that the time of you opening the share sheet and the log entry from the shortcuts actions will be almost identical.

Greetings Wayne

Re the premise of the question, ALL iphone stock apps have full access to your data. There is no security implication in that, and you do not need, indeed cannot, give or remove permission.