agentsclimarketplace
Sign in

17 mobile security

Skill Masriyan/Claude-Code-CyberSecurity-Skill/skills/17-mobile-security

Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessmentsFrom its SKILL.md

Install
npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 17-mobile-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • runs commandsInstructs the agent to run 8 commands, including `pip install requests pyaxmlparser` and 7 more.

SKILL.md

8.1 KB, ~1.9k tokens by cl100k_base, as published. Nobody here has run it

Mobile Application Security

Purpose

Enable Claude to assess Android and iOS application security against the OWASP MASVS (Mobile Application Security Verification Standard) and execute tests from the OWASP MASTG (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.

Authorization Required: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.

Activation Triggers

This skill activates when the user asks about:

  • Android (APK/AAB) or iOS (IPA) application security testing
  • OWASP MASVS / MASTG verification or a mobile pentest checklist
  • Decompiling, reversing, or static analysis of a mobile app
  • Insecure data storage, hardcoded secrets, or keystore/keychain review
  • Certificate pinning, SSL bypass, or mobile TLS/transport security
  • Frida / objection dynamic instrumentation or runtime hooking
  • AndroidManifest.xml, exported components, deep links, or Info.plist review
  • Mobile malware analysis or suspicious APK triage
  • Root/jailbreak detection, tampering, or anti-RE controls

Prerequisites

pip install requests pyaxmlparser

Optional enhanced capabilities:

  • apktool — APK decode/rebuild
  • jadx — Dalvik → Java decompiler
  • apkid — packer/obfuscator/compiler fingerprinting
  • frida / objection — dynamic instrumentation
  • mobsf (MobSF) — automated static+dynamic analysis platform
  • Android SDK platform-tools (adb), unzip, openssl

Core Capabilities

1. APK Static Analysis

When asked to analyze an APK:

  1. Unpack & decode — apktool d app.apk; extract AndroidManifest.xml, classes*.dex, resources.arsc, native libs (lib/), and assets.
  2. Manifest review — flag:
    • android:debuggable="true", android:allowBackup="true"
    • Exported components (activity/service/receiver/provider with exported="true" or implicit via intent-filter) lacking permissions
    • usesCleartextTraffic="true" / permissive network_security_config
    • Dangerous/excessive permissions; custom permissions with weak protectionLevel
    • Deep links / android:autoVerify (app-link hijack), exported ContentProvider paths
  3. Secret hunting — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs.
  4. Decompile — jadx to Java; review auth, crypto, WebView (addJavascriptInterface, setJavaScriptEnabled, loadUrl with untrusted input), and SQL.
  5. Native & packing — apkid for packers/obfuscators; inspect lib/*/*.so for JNI entry points and hardcoded data.
  6. Signature — verify signing scheme (v1/v2/v3), debug-cert use, and integrity.

Use scripts/apk_analyzer.py for an automated first pass.

2. iOS (IPA) Static Analysis

When asked to analyze an IPA:

  1. Unzip the IPA; locate Payload/<App>.app/.
  2. Info.plist — NSAppTransportSecurity exceptions (NSAllowsArbitraryLoads), URL schemes, UIFileSharingEnabled, permission usage strings.
  3. Binary checks — encryption (cryptid), PIE, stack canaries, ARC; detect missing hardening via otool/class-dump.
  4. Secret hunting — strings and resource scan for keys, endpoints, tokens.
  5. Data storage — NSUserDefaults, Core Data, Keychain accessibility classes (avoid kSecAttrAccessibleAlways), plist data at rest.
  6. Embedded provisioning profile — entitlements, ad-hoc vs. enterprise distribution.

3. Insecure Data Storage (MASVS-STORAGE)

Review where sensitive data lands at rest:

  • Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material.
  • iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups.
  • Flag any PII, tokens, or credentials stored plaintext or with app-derived keys.

4. Network & Transport (MASVS-NETWORK)

  • Confirm TLS everywhere; no cleartext fallback.
  • Certificate/public-key pinning present and validated; document bypass via objection/Frida for testing.
  • Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment.

5. Dynamic Analysis & Instrumentation

Guide runtime testing on a rooted/jailbroken test device or emulator:

  • objection quick wins: android sslpinning disable, android root disable, keystore/keychain dump, list activities, start exported components.
  • Frida hooks for crypto APIs, auth checks, root/jailbreak detection bypass, and tracing sensitive method calls.
  • Observe filesystem and logcat for data leakage during use.

6. Platform Interaction & Anti-Tampering (MASVS-PLATFORM / RESILIENCE)

  • IPC: validate exported components, intent handling, ContentProvider permissions, custom URL schemes / deep-link validation.
  • WebView: disable JS where not needed; never expose privileged JS interfaces to untrusted content.
  • Resilience (defense-in-depth, not a vuln by itself): root/jailbreak detection, anti-debug, anti-hook, code obfuscation, integrity checks.

7. Mobile Malware Triage

For suspicious APKs: apkid packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (DexClassLoader). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.

Output Standards

# Mobile App Security Assessment — [App / Package]
Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]

## Executive Summary
[Posture, count by severity, top risks]

## MASVS Coverage
| Category | Result | Notes |
|----------|--------|-------|
| STORAGE | Fail | Token in SharedPreferences plaintext |
| CRYPTO  | Pass  | ... |
| NETWORK | Partial | No pinning |
| PLATFORM | ... |
| CODE / RESILIENCE | ... |

## Findings
### [M-01] Hardcoded API Key in resources  (High)
- MASTG-TEST ref / MASVS-STORAGE
- Evidence: res/values/strings.xml:api_key=...
- Impact / Remediation: [rotate, move to backend, ...]

## Recommendations (Prioritized)

Script Reference

apk_analyzer.py

# Static triage of an APK: manifest flags, permissions, exported components, secrets
python scripts/apk_analyzer.py --apk app.apk --output apk_report.json

# Secret-scan the decoded sources too (point at an apktool/jadx output dir)
python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json

Skill Integration

Next StepConditionTarget Skill
Backend API testingApp talks to REST/GraphQL API→ Skill 09
Deeper native/binary RE.so / obfuscated logic→ Skill 04
Malware classificationSuspicious/packed APK→ Skill 05
IOC correlationC2 / malicious infra found→ Skill 06
Crypto implementation reviewCustom crypto in app→ Skill 13

References

What ships with it: 2 files

9.3 KB alongside SKILL.md, 1 of them executable

examples/

scripts/

Gives 0 of the 12 instructions most security skills give in ~1.9k tokens

Counted across 666 of the 889 authors here whose files we hold, read 2026-09-06

  • Use parameterized queries for database accessin 82 of 666, across 79 files
  • Hash passwords with BCryptin 55 of 666, across 39 files
  • Implement rate limiting for public endpointsin 48 of 666, across 34 files
  • Use environment variables for secretsin 35 of 666
  • Scan dependencies for vulnerabilitiesin 35 of 666, across 24 files
  • Validate and sanitize all user inputin 35 of 666, across 32 files
  • Add security headers to all responsesin 34 of 666, across 20 files
  • Validate all external input at the system boundaryin 26 of 666, across 25 files
  • Use parameterized queries to prevent SQL injectionin 25 of 666, across 13 files
  • Store secrets in Vault or environment variablesin 25 of 666, across 10 files
  • Run containers as a non-root userin 21 of 666, across 18 files
  • Validate all input using Bean Validationin 19 of 666, across 5 files

Said here and by no other author read

  • Unpack and decode APK files for static analysis
  • Review Android manifest for insecure configurations
  • Scan decompiled sources for hardcoded secrets and keys
  • Verify iOS binary hardening and data storage security
  • Inspect network traffic for TLS and certificate pinning
  • Use dynamic instrumentation to bypass runtime security controls

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.