The most basic review is stuff already provided by Apple, such as "what permissions does the app request" and "who published it". You can also instruct the OS to not give the app some of the permissions it may want. All apps published through the store are digitally signed, so you can be sure that the version you install is the one that was uploaded to Apple. However, Apple's review is not guaranteed to catch all the ways somebody might do something malicious with the app.
For completely black-box testing an app, the best option is network review; set it up behind an intercepting proxy such as Burp Suite, set the proxy on the device, and start capturing traffic. Verify that the app is using HTTPS or other encrypted protocols. For HTTPS, verify that it is validating TLS certificates both by signer and by host. If the app uses certificate or key pinning, you won't be able to decrypt the data (though you can still tell what hosts it tries to connect to), but if not you can decrypt the data after you install the proxy's root CA certificate on the device. This will let you see if the app is sending any data it shouldn't or to anywhere that it shouldn't.
If you want to actually inspect the app's on-device data and files, you'll need a jailbroken device. Using a privileged file browser, you can retrieve the install files and check them for any libraries from untrusted authors or known-vulnerable versions. If you really want to, you can throw the files into a disassembler / decompiler and figure out exactly what they do, though this is a skilled and somewhat laborious process even if the files aren't obfuscated at all. You can also retrieve any data files (including database files) the app stores in its sandboxed part of the file system. You can check if any sensitive data is encrypted (although its of limited use to do so unless the app itself demands a password at startup; there's nowhere to store the key that an attacker with root access couldn't access with enough effort), or if it's storing data you don't expect it to. You can also check the app's keychain, and see what's stored there.
