https://support.apple.com/guide/shortcuts/enable-or-disable-...

All of the ones on the "cannot be run automatically" list are things that a bad actor could do if they had your phone, like wait for a certain time of day, or move your phone to a specific location, or bring it in range of a particular bluetooth or wifi device.

But then, NFC is on the "can be run automatically" list, meaning that a bad actor could touch your phone to a NFC tag to trigger an action, so that doesn't make much sense. The rest of the items on the "can be run automatically" list are all ones that require your phone to be unlocked (I think).

Very odd choice by Apple for something that will be used by relatively few people and would greatly increase the usability of the feature

Passive automations based on location, bluetooth, wifi, etc. stand a good chance of many accidental triggers. Connections are flaky, location accuracy is flaky; without some form of throttling mechanism or way to better control accidental firings, it should remain manual.

Say for example someone setting one up on someone else's phone (without their knowledge) to run every X minutes and using it to track someone's location, without them ever knowing about it.

I'm not entirely sure that's the real reason behind these notifications, but it does seem plausible.

"The shortcut 'Foo' wants to run. Do you want to allow it?

- Never

- Not this time

- Run once

- Always"

Put an icon next to each shortcut showing whether it's always (or never) allowed, and it seems like the problem would be largely solved without asking much from the end user.

What you want to do is periodically (at a random time each time) ask the user if they still want it to do the privacy sensitive action still. This way, it vastly increases the chances of detection if the action was added by a third party.

Location accuracy isn't always the greatest, particularly indoors; in-and-out connections to wifi/bluetooth are possible when you're on the fringe of its range.

These issues need to be addressed in some form before _true_ automation is given to them.

It would be nice if these automations could run automatically but perhaps, notify the user that said automation has run and allow them to easily disable the automation.

They could also do what Gmail and possibly others do when forwarding is added. An obnoxious red colored warning at top of Gmail for 7 days about new forwarding. iOS could do that in some fashion.

Apple could do something like that. Probably a bit more sophisticated.

Hopefully they'll have the notifications there, if they don't already.

Try home assistant. Open source. Integrates with nearly everything, including apple homekit stuff.