Creator · Masriyan
Last updated · Sep 5, 2026
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
Creator · Masriyan
Last updated · Sep 5, 2026
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
Creator · Masriyan
Last updated · Sep 5, 2026
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
Creator · Masriyan
Last updated · Sep 5, 2026
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
Do not auto-install
Install targets
Codex install prompt
Install the "Mobile Application Security" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/17-mobile-security. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"masriyan-mobile-application-security","task":"Install Mobile Application Security","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Coding agents
I need a coding agent that can understand a repository, edit code, and review pull requests.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Maintenance
fresh
2d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
397
77/100 Quality · 65/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
397 GitHub stars
Repo activity
397 stars, 75 forks
Maintenance
2d since push
License
MIT
Install
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/masriyan-mobile-application-security/install
Agent should check
Copy prompt
Task: Use Mobile Application Security in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install
Install command: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/masriyan-mobile-application-security/install
LLM text format
/api/skills/masriyan-mobile-application-security/install?format=text
Find alternatives
/api/skills/search?q=Mobile%20Application%20Security&limit=3
Agent prompt
Use Mobile Application Security for this task. Review https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install, then install with: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/masriyan-mobile-application-security
LLM text
/api/registry/manifest/masriyan-mobile-application-security?format=text
Install alias
/api/registry/install/masriyan-mobile-application-security
Recommend
/api/registry/recommend?task=Use%20Mobile%20Application%20Security%20in%20an%20agent%20workflow&limit=3
Agent fit
Coding agents
Use-case tags
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Coding agents
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO397 GitHub stars
Stars/forks activity
INFO397 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS2d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Build and ship code
I need a coding agent that can understand a repository, edit code, and review pull requests.
Parse messy files
I need my agent to read PDFs, extract tables, and turn documents into structured data.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: Mobile Application Security description: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments version: 3.0.0 author: Masriyan tags: [cybersecurity, mobile-security, android, ios, masvs, mastg, apk, ipa, frida, reverse-engineering] ---
# Mobile Application Security
## Purpose
Enable Claude to assess Android and iOS application security against the **OWASP MASVS** (Mobile Application Security Verification Standard) and execute tests from the **OWASP MASTG** (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.
> **Authorization Required**: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.
---
## Activation Triggers
This skill activates when the user asks about: - Android (APK/AAB) or iOS (IPA) application security testing - OWASP MASVS / MASTG verification or a mobile pentest checklist - Decompiling, reversing, or static analysis of a mobile app - Insecure data storage, hardcoded secrets, or keystore/keychain review - Certificate pinning, SSL bypass, or mobile TLS/transport security - Frida / objection dynamic instrumentation or runtime hooking - `AndroidManifest.xml`, exported components, deep links, or `Info.plist` review - Mobile malware analysis or suspicious APK triage - Root/jailbreak detection, tampering, or anti-RE controls
---
## Prerequisites
```bash pip install requests pyaxmlparser ```
**Optional enhanced capabilities:** - `apktool` — APK decode/rebuild - `jadx` — Dalvik → Java decompiler - `apkid` — packer/obfuscator/compiler fingerprinting - `frida` / `objection` — dynamic instrumentation - `mobsf` (MobSF) — automated static+dynamic analysis platform - Android SDK platform-tools (`adb`), `unzip`, `openssl`
---
## Core Capabilities
### 1. APK Static Analysis
When asked to analyze an APK: 1. **Unpack & decode** — `apktool d app.apk`; extract `AndroidManifest.xml`, `classes*.dex`, `resources.arsc`, native libs (`lib/`), and assets. 2. **Manifest review** — flag: - `android:debuggable="true"`, `android:allowBackup="true"` - Exported components (`activity`/`service`/`receiver`/`provider` with `exported="true"` or implicit via intent-filter) lacking permissions - `usesCleartextTraffic="true"` / permissive `network_security_config` - Dangerous/excessive permissions; custom permissions with weak `protectionLevel` - Deep links / `android:autoVerify` (app-link hijack), exported `ContentProvider` paths 3. **Secret hunting** — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs. 4. **Decompile** — `jadx` to Java; review auth, crypto, WebView (`addJavascriptInterface`, `setJavaScriptEnabled`, `loadUrl` with untrusted input), and SQL. 5. **Native & packing** — `apkid` for packers/obfuscators; inspect `lib/*/*.so` for JNI entry points and hardcoded data. 6. **Signature** — verify signing scheme (v1/v2/v3), debug-cert use, and integrity.
Use `scripts/apk_analyzer.py` for an automated first pass.
### 2. iOS (IPA) Static Analysis
When asked to analyze an IPA: 1. Unzip the IPA; locate `Payload/<App>.app/`. 2. **`Info.plist`** — `NSAppTransportSecurity` exceptions (`NSAllowsArbitraryLoads`), URL schemes, `UIFileSharingEnabled`, permission usage strings. 3. **Binary checks** — encryption (`cryptid`), PIE, stack canaries, ARC; detect missing hardening via `otool`/`class-dump`. 4. **Secret hunting** — `strings` and resource scan for keys, endpoints, tokens. 5. **Data storage** — `NSUserDefaults`, Core Data, Keychain accessibility classes (avoid `kSecAttrAccessibleAlways`), plist data at rest. 6. **Embedded provisioning profile** — entitlements, ad-hoc vs. enterprise distribution.
### 3. Insecure Data Storage (MASVS-STORAGE)
Review where sensitive data lands at rest: - Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material. - iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups. - Flag any PII, tokens, or credentials stored plaintext or with app-derived keys.
### 4. Network & Transport (MASVS-NETWORK)
- Confirm TLS everywhere; no cleartext fallback. - **Certificate/public-key pinning** present and validated; document bypass via objection/Frida for testing. - Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment.
### 5. Dynamic Analysis & Instrumentation
Guide runtime testing on a rooted/jailbroken test device or emulator: - **objection** quick wins: `android sslpinning disable`, `android root disable`, keystore/keychain dump, list activities, start exported components. - **Frida** hooks for crypto APIs, auth checks, root/jailbreak detection bypass, and tracing sensitive method calls. - Observe filesystem and logcat for data leakage during use.
### 6. Platform Interaction & Anti-Tampering (MASVS-PLATFORM / RESILIENCE)
- IPC: validate exported components, intent handling, `ContentProvider` permissions, custom URL schemes / deep-link validation. - WebView: disable JS where not needed; never expose privileged JS interfaces to untrusted content. - Resilience (defense-in-depth, not a vuln by itself): root/jailbreak detection, anti-debug, anti-hook, code obfuscation, integrity checks.
### 7. Mobile Malware Triage
For suspicious APKs: `apkid` packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (`DexClassLoader`). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.
---
## Output Standards
```markdown # Mobile App Security Assessment — [App / Package] Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]
## Executive Summary [Posture, count by severity, top risks]
## MASVS Coverage | Category | Result | Notes | |----------|--------|-------| | STORAGE | Fail | Token in SharedPreferences plaintext | | CRYPTO | Pass | ... | | NETWORK | Partial | No pinning | | PLATFORM | ... | | CODE / RESILIENCE | ... |
## Findings ### [M-01] Hardcoded API Key in resources (High) - MASTG-TEST ref / MASVS-STORAGE - Evidence: res/values/strings.xml:api_key=... - Impact / Remediation: [rotate, move to backend, ...]
## Recommendations (Prioritized) ```
---
## Script Reference
### `apk_analyzer.py` ```bash # Static triage of an APK: manifest flags, permissions, exported components, secrets python scripts/apk_analyzer.py --apk app.apk --output apk_report.json
# Secret-scan the decoded sources too (point at an apktool/jadx output dir) python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json ```
---
## Skill Integration
| Next Step | Condition | Target Skill | |-----------|-----------|--------------| | Backend API testing | App talks to REST/GraphQL API | → Skill 09 | | Deeper native/binary RE | `.so` / obfuscated logic | → Skill 04 | | Malware classification | Suspicious/packed APK | → Skill 05 | | IOC correlation | C2 / malicious infra found | → Skill 06 | | Crypto implementation review | Custom crypto in app | → Skill 13 |
---
## References
- [OWASP MASVS — Mobile App Security Verification Standard](https://mas.owasp.org/MASVS/) - [OWASP MASTG — Mobile App Security Testing Guide](https://mas.owasp.org/MASTG/) - [OWASP Mobile Top 10 (2024)](https://owasp.org/www-project-mobile-top-10/) - [Frida — Dynamic instrumentation toolkit](https://frida.re/) - [objection — Runtime mobile exploration](https://github.com/sensepost/objection) - [MobSF — Mobile Security Framework](https://github.com/MobSF/Mobile-Security-Framework-MobSF)
Source provenance
Decision snapshot
recent repository activity
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for Mobile Application Security, ready for a manual X post.
Mobile Application Security: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspectio... 397 stars https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x
Listing + install path for Mobile Application Security: https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x Install: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Applicatio...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to Masriyan but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security/audit)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)Masriyan
@masriyan
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "Mobile Application Security" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/17-mobile-security. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"masriyan-mobile-application-security","task":"Install Mobile Application Security","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Coding agents
I need a coding agent that can understand a repository, edit code, and review pull requests.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Maintenance
fresh
2d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
397
77/100 Quality · 65/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
397 GitHub stars
Repo activity
397 stars, 75 forks
Maintenance
2d since push
License
MIT
Install
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/masriyan-mobile-application-security/install
Agent should check
Copy prompt
Task: Use Mobile Application Security in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install
Install command: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/masriyan-mobile-application-security/install
LLM text format
/api/skills/masriyan-mobile-application-security/install?format=text
Find alternatives
/api/skills/search?q=Mobile%20Application%20Security&limit=3
Agent prompt
Use Mobile Application Security for this task. Review https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install, then install with: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/masriyan-mobile-application-security
LLM text
/api/registry/manifest/masriyan-mobile-application-security?format=text
Install alias
/api/registry/install/masriyan-mobile-application-security
Recommend
/api/registry/recommend?task=Use%20Mobile%20Application%20Security%20in%20an%20agent%20workflow&limit=3
Agent fit
Coding agents
Use-case tags
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Coding agents
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO397 GitHub stars
Stars/forks activity
INFO397 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS2d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Build and ship code
I need a coding agent that can understand a repository, edit code, and review pull requests.
Parse messy files
I need my agent to read PDFs, extract tables, and turn documents into structured data.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: Mobile Application Security description: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments version: 3.0.0 author: Masriyan tags: [cybersecurity, mobile-security, android, ios, masvs, mastg, apk, ipa, frida, reverse-engineering] ---
# Mobile Application Security
## Purpose
Enable Claude to assess Android and iOS application security against the **OWASP MASVS** (Mobile Application Security Verification Standard) and execute tests from the **OWASP MASTG** (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.
> **Authorization Required**: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.
---
## Activation Triggers
This skill activates when the user asks about: - Android (APK/AAB) or iOS (IPA) application security testing - OWASP MASVS / MASTG verification or a mobile pentest checklist - Decompiling, reversing, or static analysis of a mobile app - Insecure data storage, hardcoded secrets, or keystore/keychain review - Certificate pinning, SSL bypass, or mobile TLS/transport security - Frida / objection dynamic instrumentation or runtime hooking - `AndroidManifest.xml`, exported components, deep links, or `Info.plist` review - Mobile malware analysis or suspicious APK triage - Root/jailbreak detection, tampering, or anti-RE controls
---
## Prerequisites
```bash pip install requests pyaxmlparser ```
**Optional enhanced capabilities:** - `apktool` — APK decode/rebuild - `jadx` — Dalvik → Java decompiler - `apkid` — packer/obfuscator/compiler fingerprinting - `frida` / `objection` — dynamic instrumentation - `mobsf` (MobSF) — automated static+dynamic analysis platform - Android SDK platform-tools (`adb`), `unzip`, `openssl`
---
## Core Capabilities
### 1. APK Static Analysis
When asked to analyze an APK: 1. **Unpack & decode** — `apktool d app.apk`; extract `AndroidManifest.xml`, `classes*.dex`, `resources.arsc`, native libs (`lib/`), and assets. 2. **Manifest review** — flag: - `android:debuggable="true"`, `android:allowBackup="true"` - Exported components (`activity`/`service`/`receiver`/`provider` with `exported="true"` or implicit via intent-filter) lacking permissions - `usesCleartextTraffic="true"` / permissive `network_security_config` - Dangerous/excessive permissions; custom permissions with weak `protectionLevel` - Deep links / `android:autoVerify` (app-link hijack), exported `ContentProvider` paths 3. **Secret hunting** — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs. 4. **Decompile** — `jadx` to Java; review auth, crypto, WebView (`addJavascriptInterface`, `setJavaScriptEnabled`, `loadUrl` with untrusted input), and SQL. 5. **Native & packing** — `apkid` for packers/obfuscators; inspect `lib/*/*.so` for JNI entry points and hardcoded data. 6. **Signature** — verify signing scheme (v1/v2/v3), debug-cert use, and integrity.
Use `scripts/apk_analyzer.py` for an automated first pass.
### 2. iOS (IPA) Static Analysis
When asked to analyze an IPA: 1. Unzip the IPA; locate `Payload/<App>.app/`. 2. **`Info.plist`** — `NSAppTransportSecurity` exceptions (`NSAllowsArbitraryLoads`), URL schemes, `UIFileSharingEnabled`, permission usage strings. 3. **Binary checks** — encryption (`cryptid`), PIE, stack canaries, ARC; detect missing hardening via `otool`/`class-dump`. 4. **Secret hunting** — `strings` and resource scan for keys, endpoints, tokens. 5. **Data storage** — `NSUserDefaults`, Core Data, Keychain accessibility classes (avoid `kSecAttrAccessibleAlways`), plist data at rest. 6. **Embedded provisioning profile** — entitlements, ad-hoc vs. enterprise distribution.
### 3. Insecure Data Storage (MASVS-STORAGE)
Review where sensitive data lands at rest: - Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material. - iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups. - Flag any PII, tokens, or credentials stored plaintext or with app-derived keys.
### 4. Network & Transport (MASVS-NETWORK)
- Confirm TLS everywhere; no cleartext fallback. - **Certificate/public-key pinning** present and validated; document bypass via objection/Frida for testing. - Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment.
### 5. Dynamic Analysis & Instrumentation
Guide runtime testing on a rooted/jailbroken test device or emulator: - **objection** quick wins: `android sslpinning disable`, `android root disable`, keystore/keychain dump, list activities, start exported components. - **Frida** hooks for crypto APIs, auth checks, root/jailbreak detection bypass, and tracing sensitive method calls. - Observe filesystem and logcat for data leakage during use.
### 6. Platform Interaction & Anti-Tampering (MASVS-PLATFORM / RESILIENCE)
- IPC: validate exported components, intent handling, `ContentProvider` permissions, custom URL schemes / deep-link validation. - WebView: disable JS where not needed; never expose privileged JS interfaces to untrusted content. - Resilience (defense-in-depth, not a vuln by itself): root/jailbreak detection, anti-debug, anti-hook, code obfuscation, integrity checks.
### 7. Mobile Malware Triage
For suspicious APKs: `apkid` packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (`DexClassLoader`). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.
---
## Output Standards
```markdown # Mobile App Security Assessment — [App / Package] Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]
## Executive Summary [Posture, count by severity, top risks]
## MASVS Coverage | Category | Result | Notes | |----------|--------|-------| | STORAGE | Fail | Token in SharedPreferences plaintext | | CRYPTO | Pass | ... | | NETWORK | Partial | No pinning | | PLATFORM | ... | | CODE / RESILIENCE | ... |
## Findings ### [M-01] Hardcoded API Key in resources (High) - MASTG-TEST ref / MASVS-STORAGE - Evidence: res/values/strings.xml:api_key=... - Impact / Remediation: [rotate, move to backend, ...]
## Recommendations (Prioritized) ```
---
## Script Reference
### `apk_analyzer.py` ```bash # Static triage of an APK: manifest flags, permissions, exported components, secrets python scripts/apk_analyzer.py --apk app.apk --output apk_report.json
# Secret-scan the decoded sources too (point at an apktool/jadx output dir) python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json ```
---
## Skill Integration
| Next Step | Condition | Target Skill | |-----------|-----------|--------------| | Backend API testing | App talks to REST/GraphQL API | → Skill 09 | | Deeper native/binary RE | `.so` / obfuscated logic | → Skill 04 | | Malware classification | Suspicious/packed APK | → Skill 05 | | IOC correlation | C2 / malicious infra found | → Skill 06 | | Crypto implementation review | Custom crypto in app | → Skill 13 |
---
## References
- [OWASP MASVS — Mobile App Security Verification Standard](https://mas.owasp.org/MASVS/) - [OWASP MASTG — Mobile App Security Testing Guide](https://mas.owasp.org/MASTG/) - [OWASP Mobile Top 10 (2024)](https://owasp.org/www-project-mobile-top-10/) - [Frida — Dynamic instrumentation toolkit](https://frida.re/) - [objection — Runtime mobile exploration](https://github.com/sensepost/objection) - [MobSF — Mobile Security Framework](https://github.com/MobSF/Mobile-Security-Framework-MobSF)
Source provenance
Decision snapshot
recent repository activity
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for Mobile Application Security, ready for a manual X post.
Mobile Application Security: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspectio... 397 stars https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x
Listing + install path for Mobile Application Security: https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x Install: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Applicatio...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to Masriyan but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security/audit)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)Masriyan
@masriyan
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "Mobile Application Security" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/17-mobile-security. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"masriyan-mobile-application-security","task":"Install Mobile Application Security","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Coding agents
I need a coding agent that can understand a repository, edit code, and review pull requests.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Maintenance
fresh
2d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
397
77/100 Quality · 65/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
397 GitHub stars
Repo activity
397 stars, 75 forks
Maintenance
2d since push
License
MIT
Install
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/masriyan-mobile-application-security/install
Agent should check
Copy prompt
Task: Use Mobile Application Security in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install
Install command: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/masriyan-mobile-application-security/install
LLM text format
/api/skills/masriyan-mobile-application-security/install?format=text
Find alternatives
/api/skills/search?q=Mobile%20Application%20Security&limit=3
Agent prompt
Use Mobile Application Security for this task. Review https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install, then install with: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/masriyan-mobile-application-security
LLM text
/api/registry/manifest/masriyan-mobile-application-security?format=text
Install alias
/api/registry/install/masriyan-mobile-application-security
Recommend
/api/registry/recommend?task=Use%20Mobile%20Application%20Security%20in%20an%20agent%20workflow&limit=3
Agent fit
Coding agents
Use-case tags
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Coding agents
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO397 GitHub stars
Stars/forks activity
INFO397 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS2d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Build and ship code
I need a coding agent that can understand a repository, edit code, and review pull requests.
Parse messy files
I need my agent to read PDFs, extract tables, and turn documents into structured data.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: Mobile Application Security description: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments version: 3.0.0 author: Masriyan tags: [cybersecurity, mobile-security, android, ios, masvs, mastg, apk, ipa, frida, reverse-engineering] ---
# Mobile Application Security
## Purpose
Enable Claude to assess Android and iOS application security against the **OWASP MASVS** (Mobile Application Security Verification Standard) and execute tests from the **OWASP MASTG** (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.
> **Authorization Required**: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.
---
## Activation Triggers
This skill activates when the user asks about: - Android (APK/AAB) or iOS (IPA) application security testing - OWASP MASVS / MASTG verification or a mobile pentest checklist - Decompiling, reversing, or static analysis of a mobile app - Insecure data storage, hardcoded secrets, or keystore/keychain review - Certificate pinning, SSL bypass, or mobile TLS/transport security - Frida / objection dynamic instrumentation or runtime hooking - `AndroidManifest.xml`, exported components, deep links, or `Info.plist` review - Mobile malware analysis or suspicious APK triage - Root/jailbreak detection, tampering, or anti-RE controls
---
## Prerequisites
```bash pip install requests pyaxmlparser ```
**Optional enhanced capabilities:** - `apktool` — APK decode/rebuild - `jadx` — Dalvik → Java decompiler - `apkid` — packer/obfuscator/compiler fingerprinting - `frida` / `objection` — dynamic instrumentation - `mobsf` (MobSF) — automated static+dynamic analysis platform - Android SDK platform-tools (`adb`), `unzip`, `openssl`
---
## Core Capabilities
### 1. APK Static Analysis
When asked to analyze an APK: 1. **Unpack & decode** — `apktool d app.apk`; extract `AndroidManifest.xml`, `classes*.dex`, `resources.arsc`, native libs (`lib/`), and assets. 2. **Manifest review** — flag: - `android:debuggable="true"`, `android:allowBackup="true"` - Exported components (`activity`/`service`/`receiver`/`provider` with `exported="true"` or implicit via intent-filter) lacking permissions - `usesCleartextTraffic="true"` / permissive `network_security_config` - Dangerous/excessive permissions; custom permissions with weak `protectionLevel` - Deep links / `android:autoVerify` (app-link hijack), exported `ContentProvider` paths 3. **Secret hunting** — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs. 4. **Decompile** — `jadx` to Java; review auth, crypto, WebView (`addJavascriptInterface`, `setJavaScriptEnabled`, `loadUrl` with untrusted input), and SQL. 5. **Native & packing** — `apkid` for packers/obfuscators; inspect `lib/*/*.so` for JNI entry points and hardcoded data. 6. **Signature** — verify signing scheme (v1/v2/v3), debug-cert use, and integrity.
Use `scripts/apk_analyzer.py` for an automated first pass.
### 2. iOS (IPA) Static Analysis
When asked to analyze an IPA: 1. Unzip the IPA; locate `Payload/<App>.app/`. 2. **`Info.plist`** — `NSAppTransportSecurity` exceptions (`NSAllowsArbitraryLoads`), URL schemes, `UIFileSharingEnabled`, permission usage strings. 3. **Binary checks** — encryption (`cryptid`), PIE, stack canaries, ARC; detect missing hardening via `otool`/`class-dump`. 4. **Secret hunting** — `strings` and resource scan for keys, endpoints, tokens. 5. **Data storage** — `NSUserDefaults`, Core Data, Keychain accessibility classes (avoid `kSecAttrAccessibleAlways`), plist data at rest. 6. **Embedded provisioning profile** — entitlements, ad-hoc vs. enterprise distribution.
### 3. Insecure Data Storage (MASVS-STORAGE)
Review where sensitive data lands at rest: - Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material. - iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups. - Flag any PII, tokens, or credentials stored plaintext or with app-derived keys.
### 4. Network & Transport (MASVS-NETWORK)
- Confirm TLS everywhere; no cleartext fallback. - **Certificate/public-key pinning** present and validated; document bypass via objection/Frida for testing. - Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment.
### 5. Dynamic Analysis & Instrumentation
Guide runtime testing on a rooted/jailbroken test device or emulator: - **objection** quick wins: `android sslpinning disable`, `android root disable`, keystore/keychain dump, list activities, start exported components. - **Frida** hooks for crypto APIs, auth checks, root/jailbreak detection bypass, and tracing sensitive method calls. - Observe filesystem and logcat for data leakage during use.
### 6. Platform Interaction & Anti-Tampering (MASVS-PLATFORM / RESILIENCE)
- IPC: validate exported components, intent handling, `ContentProvider` permissions, custom URL schemes / deep-link validation. - WebView: disable JS where not needed; never expose privileged JS interfaces to untrusted content. - Resilience (defense-in-depth, not a vuln by itself): root/jailbreak detection, anti-debug, anti-hook, code obfuscation, integrity checks.
### 7. Mobile Malware Triage
For suspicious APKs: `apkid` packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (`DexClassLoader`). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.
---
## Output Standards
```markdown # Mobile App Security Assessment — [App / Package] Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]
## Executive Summary [Posture, count by severity, top risks]
## MASVS Coverage | Category | Result | Notes | |----------|--------|-------| | STORAGE | Fail | Token in SharedPreferences plaintext | | CRYPTO | Pass | ... | | NETWORK | Partial | No pinning | | PLATFORM | ... | | CODE / RESILIENCE | ... |
## Findings ### [M-01] Hardcoded API Key in resources (High) - MASTG-TEST ref / MASVS-STORAGE - Evidence: res/values/strings.xml:api_key=... - Impact / Remediation: [rotate, move to backend, ...]
## Recommendations (Prioritized) ```
---
## Script Reference
### `apk_analyzer.py` ```bash # Static triage of an APK: manifest flags, permissions, exported components, secrets python scripts/apk_analyzer.py --apk app.apk --output apk_report.json
# Secret-scan the decoded sources too (point at an apktool/jadx output dir) python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json ```
---
## Skill Integration
| Next Step | Condition | Target Skill | |-----------|-----------|--------------| | Backend API testing | App talks to REST/GraphQL API | → Skill 09 | | Deeper native/binary RE | `.so` / obfuscated logic | → Skill 04 | | Malware classification | Suspicious/packed APK | → Skill 05 | | IOC correlation | C2 / malicious infra found | → Skill 06 | | Crypto implementation review | Custom crypto in app | → Skill 13 |
---
## References
- [OWASP MASVS — Mobile App Security Verification Standard](https://mas.owasp.org/MASVS/) - [OWASP MASTG — Mobile App Security Testing Guide](https://mas.owasp.org/MASTG/) - [OWASP Mobile Top 10 (2024)](https://owasp.org/www-project-mobile-top-10/) - [Frida — Dynamic instrumentation toolkit](https://frida.re/) - [objection — Runtime mobile exploration](https://github.com/sensepost/objection) - [MobSF — Mobile Security Framework](https://github.com/MobSF/Mobile-Security-Framework-MobSF)
Source provenance
Decision snapshot
recent repository activity
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for Mobile Application Security, ready for a manual X post.
Mobile Application Security: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspectio... 397 stars https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x
Listing + install path for Mobile Application Security: https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x Install: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Applicatio...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to Masriyan but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security/audit)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)Masriyan
@masriyan
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "Mobile Application Security" agent skill from https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill/tree/main/skills/17-mobile-security. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"masriyan-mobile-application-security","task":"Install Mobile Application Security","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Coding agents
I need a coding agent that can understand a repository, edit code, and review pull requests.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Maintenance
fresh
2d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
397
77/100 Quality · 65/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
397 GitHub stars
Repo activity
397 stars, 75 forks
Maintenance
2d since push
License
MIT
Install
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/masriyan-mobile-application-security/install
Agent should check
Copy prompt
Task: Use Mobile Application Security in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20Mobile%20Application%20Security%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install
Install command: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application Security
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/masriyan-mobile-application-security/install
LLM text format
/api/skills/masriyan-mobile-application-security/install?format=text
Find alternatives
/api/skills/search?q=Mobile%20Application%20Security&limit=3
Agent prompt
Use Mobile Application Security for this task. Review https://www.openagentskill.com/api/skills/masriyan-mobile-application-security/install, then install with: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Application SecurityRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/masriyan-mobile-application-security
LLM text
/api/registry/manifest/masriyan-mobile-application-security?format=text
Install alias
/api/registry/install/masriyan-mobile-application-security
Recommend
/api/registry/recommend?task=Use%20Mobile%20Application%20Security%20in%20an%20agent%20workflow&limit=3
Agent fit
Coding agents
Use-case tags
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Coding agents
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO397 GitHub stars
Stars/forks activity
INFO397 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS2d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Build and ship code
I need a coding agent that can understand a repository, edit code, and review pull requests.
Parse messy files
I need my agent to read PDFs, extract tables, and turn documents into structured data.
Investigate faster
I need my agent to research a topic, compare sources, and produce a concise report.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Find, compare, and synthesize
A workflow for agents that gather sources, compare claims, summarize long material, and draft useful research briefs.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: Mobile Application Security description: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments version: 3.0.0 author: Masriyan tags: [cybersecurity, mobile-security, android, ios, masvs, mastg, apk, ipa, frida, reverse-engineering] ---
# Mobile Application Security
## Purpose
Enable Claude to assess Android and iOS application security against the **OWASP MASVS** (Mobile Application Security Verification Standard) and execute tests from the **OWASP MASTG** (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.
> **Authorization Required**: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.
---
## Activation Triggers
This skill activates when the user asks about: - Android (APK/AAB) or iOS (IPA) application security testing - OWASP MASVS / MASTG verification or a mobile pentest checklist - Decompiling, reversing, or static analysis of a mobile app - Insecure data storage, hardcoded secrets, or keystore/keychain review - Certificate pinning, SSL bypass, or mobile TLS/transport security - Frida / objection dynamic instrumentation or runtime hooking - `AndroidManifest.xml`, exported components, deep links, or `Info.plist` review - Mobile malware analysis or suspicious APK triage - Root/jailbreak detection, tampering, or anti-RE controls
---
## Prerequisites
```bash pip install requests pyaxmlparser ```
**Optional enhanced capabilities:** - `apktool` — APK decode/rebuild - `jadx` — Dalvik → Java decompiler - `apkid` — packer/obfuscator/compiler fingerprinting - `frida` / `objection` — dynamic instrumentation - `mobsf` (MobSF) — automated static+dynamic analysis platform - Android SDK platform-tools (`adb`), `unzip`, `openssl`
---
## Core Capabilities
### 1. APK Static Analysis
When asked to analyze an APK: 1. **Unpack & decode** — `apktool d app.apk`; extract `AndroidManifest.xml`, `classes*.dex`, `resources.arsc`, native libs (`lib/`), and assets. 2. **Manifest review** — flag: - `android:debuggable="true"`, `android:allowBackup="true"` - Exported components (`activity`/`service`/`receiver`/`provider` with `exported="true"` or implicit via intent-filter) lacking permissions - `usesCleartextTraffic="true"` / permissive `network_security_config` - Dangerous/excessive permissions; custom permissions with weak `protectionLevel` - Deep links / `android:autoVerify` (app-link hijack), exported `ContentProvider` paths 3. **Secret hunting** — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs. 4. **Decompile** — `jadx` to Java; review auth, crypto, WebView (`addJavascriptInterface`, `setJavaScriptEnabled`, `loadUrl` with untrusted input), and SQL. 5. **Native & packing** — `apkid` for packers/obfuscators; inspect `lib/*/*.so` for JNI entry points and hardcoded data. 6. **Signature** — verify signing scheme (v1/v2/v3), debug-cert use, and integrity.
Use `scripts/apk_analyzer.py` for an automated first pass.
### 2. iOS (IPA) Static Analysis
When asked to analyze an IPA: 1. Unzip the IPA; locate `Payload/<App>.app/`. 2. **`Info.plist`** — `NSAppTransportSecurity` exceptions (`NSAllowsArbitraryLoads`), URL schemes, `UIFileSharingEnabled`, permission usage strings. 3. **Binary checks** — encryption (`cryptid`), PIE, stack canaries, ARC; detect missing hardening via `otool`/`class-dump`. 4. **Secret hunting** — `strings` and resource scan for keys, endpoints, tokens. 5. **Data storage** — `NSUserDefaults`, Core Data, Keychain accessibility classes (avoid `kSecAttrAccessibleAlways`), plist data at rest. 6. **Embedded provisioning profile** — entitlements, ad-hoc vs. enterprise distribution.
### 3. Insecure Data Storage (MASVS-STORAGE)
Review where sensitive data lands at rest: - Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material. - iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups. - Flag any PII, tokens, or credentials stored plaintext or with app-derived keys.
### 4. Network & Transport (MASVS-NETWORK)
- Confirm TLS everywhere; no cleartext fallback. - **Certificate/public-key pinning** present and validated; document bypass via objection/Frida for testing. - Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment.
### 5. Dynamic Analysis & Instrumentation
Guide runtime testing on a rooted/jailbroken test device or emulator: - **objection** quick wins: `android sslpinning disable`, `android root disable`, keystore/keychain dump, list activities, start exported components. - **Frida** hooks for crypto APIs, auth checks, root/jailbreak detection bypass, and tracing sensitive method calls. - Observe filesystem and logcat for data leakage during use.
### 6. Platform Interaction & Anti-Tampering (MASVS-PLATFORM / RESILIENCE)
- IPC: validate exported components, intent handling, `ContentProvider` permissions, custom URL schemes / deep-link validation. - WebView: disable JS where not needed; never expose privileged JS interfaces to untrusted content. - Resilience (defense-in-depth, not a vuln by itself): root/jailbreak detection, anti-debug, anti-hook, code obfuscation, integrity checks.
### 7. Mobile Malware Triage
For suspicious APKs: `apkid` packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (`DexClassLoader`). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.
---
## Output Standards
```markdown # Mobile App Security Assessment — [App / Package] Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]
## Executive Summary [Posture, count by severity, top risks]
## MASVS Coverage | Category | Result | Notes | |----------|--------|-------| | STORAGE | Fail | Token in SharedPreferences plaintext | | CRYPTO | Pass | ... | | NETWORK | Partial | No pinning | | PLATFORM | ... | | CODE / RESILIENCE | ... |
## Findings ### [M-01] Hardcoded API Key in resources (High) - MASTG-TEST ref / MASVS-STORAGE - Evidence: res/values/strings.xml:api_key=... - Impact / Remediation: [rotate, move to backend, ...]
## Recommendations (Prioritized) ```
---
## Script Reference
### `apk_analyzer.py` ```bash # Static triage of an APK: manifest flags, permissions, exported components, secrets python scripts/apk_analyzer.py --apk app.apk --output apk_report.json
# Secret-scan the decoded sources too (point at an apktool/jadx output dir) python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json ```
---
## Skill Integration
| Next Step | Condition | Target Skill | |-----------|-----------|--------------| | Backend API testing | App talks to REST/GraphQL API | → Skill 09 | | Deeper native/binary RE | `.so` / obfuscated logic | → Skill 04 | | Malware classification | Suspicious/packed APK | → Skill 05 | | IOC correlation | C2 / malicious infra found | → Skill 06 | | Crypto implementation review | Custom crypto in app | → Skill 13 |
---
## References
- [OWASP MASVS — Mobile App Security Verification Standard](https://mas.owasp.org/MASVS/) - [OWASP MASTG — Mobile App Security Testing Guide](https://mas.owasp.org/MASTG/) - [OWASP Mobile Top 10 (2024)](https://owasp.org/www-project-mobile-top-10/) - [Frida — Dynamic instrumentation toolkit](https://frida.re/) - [objection — Runtime mobile exploration](https://github.com/sensepost/objection) - [MobSF — Mobile Security Framework](https://github.com/MobSF/Mobile-Security-Framework-MobSF)
Source provenance
Decision snapshot
recent repository activity
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for Mobile Application Security, ready for a manual X post.
Mobile Application Security: Android and iOS application security testing — static and dynamic analysis, APK/IPA inspectio... 397 stars https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x
Listing + install path for Mobile Application Security: https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=x Install: npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill Mobile Applicatio...
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to Masriyan but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security/audit)
[](https://www.openagentskill.com/skills/masriyan-mobile-application-security?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)Masriyan
@masriyan
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsPermission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness