Skill UI

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

This skill implements a comprehensive brand monitoring system to detect brand impersonation attacks across multiple digital attack surfaces, including domain squatting, social media profiles, phishing sites, mobile apps, and the dark web. It uses tools like dnstwist and integrates APIs (Google Safe Browsing, VirusTotal) to proactively identify unauthorized brand usage and potential cyber threats targeting an organization.

A comprehensive guide detailing the process of acquiring and analyzing data from smartphones and tablets. It covers best practices for device isolation, physical/logical acquisition using tools like Cellebrite UFED and open-source alternatives (ALEAPP, iLEAPP), and subsequent deep analysis of communications, call logs, and application artifacts for legal or corporate investigations.

This comprehensive guide covers the principles and implementation steps for building Progressive Web Apps (PWAs). Learn to integrate essential components like Web App Manifests and Service Workers to ensure your web application offers a reliable, fast, and truly offline-capable experience, mimicking the feel of a native mobile app. Ideal for enhancing web resilience and installability.

A comprehensive guide for statically analyzing suspicious Android APKs. This skill demonstrates how to use JADX, apktool, and androguard to decompile Java/Kotlin source code, examine manifest permissions, and identify malicious patterns. Use this to detect data exfiltration, C2 command and control communication, privilege escalation, and overlay attacks in mobile threats.

This skill is designed for assessing the security of Android inter-process communication (IPC) by systematically testing intents, broadcast receivers, content providers, and exported components. It helps identify critical vulnerabilities such as intent injection, unauthorized data leakage, and component hijacking, which are crucial during mobile penetration testing and security audits.

A comprehensive guide and toolkit for performing deep security assessments on mobile application backends. It covers identifying vulnerabilities such as broken authentication, insecure token management (JWT, opaque tokens), session fixation, privilege escalation, and IDOR (Broken Object-Level Authorization) across various OAuth flows (OIDC, PKCE). Essential for penetration testers assessing API security.

This skill scaffolds the complete boilerplate structure for a new mobile screen or page. It ensures that the resulting component adheres to established design system patterns, including Top Bars, Bottom Navigation, and standard content shells. Use it when starting a new dedicated mobile view and needing immediate adherence to design tokens and layout rules.

This skill provides a comprehensive review of UI components and codebases to ensure strict adherence to established design systems, accessibility guidelines (WCAG), and modern front-end best practices. It checks for design token compliance (e.g., semantic colors, scaled spacing), component conventions, WCAG accessibility standards (a11y), mobile responsiveness, and visual coherence across the entire application.

A comprehensive index of 46 production-grade test automation skills, covering E2E, unit, mobile, BDD, and cloud testing across 15+ languages. This skill equips AI coding assistants to act as senior QA architects, generating structured, real-world test code for major frameworks like Playwright, Selenium, Cypress, and Jest. It supports project setup, CI/CD integration, and cross-platform debugging.

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

XcodeBuildMCP is a unified skill set designed to streamline the entire mobile and desktop development lifecycle. It replaces raw command-line tools like xcodebuild, xcrun, and simctl, providing structured workflows for iOS, macOS, watchOS, tvOS, and visionOS. Capabilities include project discovery, managing simulator and physical device workflows, advanced UI automation (gestures, view inspection), robust logging, and deep debugging using LLDB. It simplifies complex build, test, and run operations across multiple platforms.