# Is It Safe to Add a Shared Shortcut From an iCloud Link? > What a shared iPhone shortcut can and can't do, how to read every step before switching it on, and what the ready-made shortcut from Fwrd contains. Last updated: 2026-10-24 Canonical HTML page: https://www.fwrdsms.com/blog/is-it-safe-to-add-a-shared-shortcut Published: 2026-10-24 It can be, as long as you open the shortcut and read its steps before you let it run. A shortcut is a list of actions, and Apple says shortcuts shared from outside its Gallery haven't been reviewed by Apple. The people who share them can't see your iPhone, but what the shortcut does is up to its author, so a minute of reading is worth it. **What you need:** an iPhone with the Shortcuts app and the iCloud link of the shortcut you're thinking of adding. ## What can a shared shortcut do on your iPhone? Only what its actions say, and each action is visible in the editor. A shortcut is a sequence of steps such as "Get text from input," "Send Message," or "Get Contents of URL." It can't do anything that isn't one of those steps. Apple's guide on [sharing shortcuts through an iCloud link](https://support.apple.com/guide/shortcuts/apdf01f8c054/ios) (read October 24, 2026) says that when someone taps the link, a description of the shortcut is displayed, and when they tap Get Shortcut, it's added to their collection. Adding a shortcut doesn't run it. Some actions can reach data or send it somewhere. For that reason Apple's [privacy settings page](https://support.apple.com/guide/shortcuts/apd961a4fc65/ios) (read October 24, 2026) describes a prompt that offers Allow Once, Always Allow, or Don't Allow when a shortcut needs your data. If you never see that prompt for a shortcut, you haven't given it that access. ## What does Apple check on a shared shortcut? Apple warns you and checks for known malware, but it doesn't review what a shortcut does. Apple's [Platform Security guide](https://support.apple.com/guide/security/secec043bdae/web) (published February 18, 2021; read October 24, 2026) says that when you download a shortcut from the internet, you're warned that Apple hasn't reviewed it and you get the chance to inspect it. It also says updated malware definitions are downloaded to identify malicious shortcuts when they run. Apple's [privacy settings page](https://support.apple.com/guide/shortcuts/apd961a4fc65/ios) adds that Apple can't verify the authenticity or behavior of shortcuts shared privately, and advises you to verify shortcuts you receive. On a shortcut link, you are the reviewer. ## How do I look inside a shortcut before switching it on? Open it in the Shortcuts app and read every step. Don't tap Run first. 1. Open the iCloud link. Shortcuts shows the description Apple mentions above, with the shortcut's name and what it says it does. 2. Read the description and the action count. A shortcut that claims to do one small thing shouldn't be dozens of steps long. 3. Tap Add Shortcut. This only puts it in your collection. Nothing runs yet. 4. Find it in your collection and open its editor. Read the actions from top to bottom. 5. Look for actions that send something out: Get Contents of URL, Send Message, Send Email, or anything that names an address or a link you don't recognize. Ask whether the text going out should go there. 6. Look for actions that read your data, such as Contacts, Photos, Files or Calendar. If the shortcut's purpose doesn't need it, leave the shortcut off. 7. Open the shortcut's Details and tap Privacy, if it shows. Apple says that if you don't see the Privacy tab, the shortcut does not have access to your data. You can turn off individual options or tap Reset Privacy. 8. If the shortcut contains an automation, switch it on only after steps 4 to 7 look right. Apple says shared automations arrive switched off. When Shortcuts asks permission while it runs, read the question. "Don't Allow" is always available, and Allow Once is there if you aren't sure. ## What can't reading a shortcut tell you? Limits to know Reading shows you the steps, but it doesn't tell you who the author is or what's on the other end of a link. - **The destination.** A "Get Contents of URL" step shows you an address. It can't show you what the service at that address does with what it receives. - **Changes later.** A shortcut you've already added doesn't change when the author edits their link. You'd have to add the new version to see it. - **Apple's review.** For shortcuts from outside the Gallery, Apple says it hasn't reviewed them. - **Your permissions.** Choosing Always Allow ends the questions for that shortcut. You can undo it from Details, then Privacy. If a step doesn't make sense, leave it off and ask the author. A shortcut you can't read isn't one to switch on. ## What does Fwrd's ready-made shortcut contain? [Fwrd](https://apps.apple.com/app/apple-store/id6759069713?pt=128544281&ct=blog-shared-shortcut&mt=8) hands you a shortcut with two parts: the Message trigger and Fwrd's "Forward Message to All Destinations" action, with the message and sender already filled in. For Email, another phone and WhatsApp, it also holds the send action, which sends to the address or number you typed into Fwrd. Apple's own action, or WhatsApp's, does that sending. On iOS 27, where shortcuts can carry their automation, Shortcuts' own Add Shortcut sheet opens when you tap Get Shortcut. iOS 26 doesn't have shared automations, so there setup stays step by step, as in [the automation guide](https://www.fwrdsms.com/guides/automation). What's in it: - It's signed by Apple and carries no name or email address of whoever shared it. - It contains only the trigger and Fwrd's action, plus the send action for Email, Phone and WhatsApp. - No Fwrd server is involved. Texts go from your iPhone to the destinations you chose. - You can open it in Shortcuts and see every step before you switch it on. - Shortcuts' own sheet shows "Can Run When Locked." The automation arrives switched off, and you turn it on from the shortcut's Edit screen. After that, Shortcuts asks two one-time permission questions, and you tap Allow, then Always Allow. That first run uses one of your 15 free forwards a month, as of October 24, 2026. ## Questions about adding shared shortcuts ### Does adding a shortcut from an iCloud link run it? No. Per Apple's sharing guide, Get Shortcut adds it to your collection. It runs when you run it, or when its automation fires if you've switched that on. ### Does Apple review shortcuts shared by link? No. Apple says it hasn't reviewed shortcuts from outside its Gallery and can't verify the behavior of shortcuts shared privately. It does check for known malicious shortcuts when they run. Reading the steps yourself is the review. ### Can a shortcut read my texts? Only if one of its steps does. A Message trigger hands the matching text to the actions after it, and you can see those actions in the editor. [Fwrd's own action](https://www.fwrdsms.com/blog/can-apps-read-your-texts-iphone) receives only what the trigger passes it. ### How do I undo a shortcut I've added? Switch off its automation, then delete the shortcut from your collection. In Details, Privacy, you can also tap Reset Privacy to remove access it was given. ## Keep reading - [Is an SMS forwarder app safe?](https://www.fwrdsms.com/blog/is-sms-forwarder-app-safe) - [One-tap iPhone text forwarding setup](https://www.fwrdsms.com/blog/one-tap-iphone-text-forwarding-setup)