Frida script review
Ai skills for Frida dynamic instrumentation across Android, iOS, native hooks, agents, and troubleshooting
npx -y skills add Rudra-ravi/frida-skills --skill frida-script-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Review, harden, and simplify Frida scripts before running CodeShare snippets, universal bypasses, broad hooks, native pointer code, Java hooks, or ObjC hooks.
SKILL.md
1.8 KB, as published. Nobody here has run it
Frida Script Review
Use this skill before running public, generated, or mutation-heavy Frida scripts.
Review Pass
- Identify platform assumptions: Android, iOS, native, desktop, Gadget.
- Identify mutation points: return replacement, argument rewrite, file writes, process control, network changes.
- Check timing: spawn vs attach, module load, class loader, ObjC availability.
- Check safety: null pointers, overloads, string lifetimes,
retvalcopies, recursion, noisy hooks. - Reduce broad bundles to the hooks relevant to the target behavior.
Red Flags
- Blind universal bypass without proof of which hook fired.
- Native pointer reads without null or length checks.
- String replacement into fixed buffers without proving buffer size.
- Java method hook without explicit overload where overloads exist.
- ObjC selector assumed without checking
ObjC.availableand class/method presence. retvalor argument wrappers stored for later use instead of copied.- Logs that print secrets unnecessarily.
Hardening Pattern
Before mutation:
console.log("hook fired", targetName);
console.log(Thread.backtrace(this.context, Backtracer.ACCURATE)
.map(DebugSymbol.fromAddress).join("\n"));
After proof:
if (shouldPatchThisCall()) {
retval.replace(1);
}
Output
Return:
- Risk summary.
- Exact lines or hook blocks to keep, remove, or change.
- Safer reviewed script or patch.
- Verification command and expected proof.
References
- Frida JavaScript API: https://frida.re/docs/javascript-api/
- Frida troubleshooting: https://frida.re/docs/troubleshooting/
- Frida CodeShare: https://codeshare.frida.re/