Skill UI

This skill performs comprehensive static analysis of Android APK malware. It utilizes industry-standard tools like androguard and apktool to decompile resources, inspect manifests, and identify dangerous permissions, obfuscated code patterns, dynamic loading mechanisms, and suspicious API calls without executing the sample. It is essential for security analysts, SOC teams, and threat hunters building detection rules or triaging suspicious malware samples.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

Napkin gives Copilot CLI users a browser whiteboard to draw, sketch, and add sticky notes; Copilot reads snapshots and JSON data, then replies with analysis, suggestions, and next steps for business-oriented thinkers.

A specialized downstream skill for complex CTF challenges, focusing on cryptographic analysis, steganography, and mobile system forensics. It guides the user through recovering complex data chains, such as decoding blobs, tracing cryptographic transforms (keys, IVs, nonces), inspecting hidden media payloads, and analyzing mobile trust boundaries (e.g., APK/IPA signing logic, local storage, SSL pinning). This skill is designed to be used only after a main sandbox orchestrator has established the operational context.

A comprehensive methodology for deep security testing of both Android (APK) and iOS (IPA) applications. This guide covers the entire workflow, from initial information gathering and static analysis (decompilation, code structure analysis) to advanced dynamic instrumentation, network interception, and bypassing modern security measures like SSL Pinning, Root/Jailbreak detection, and anti-debugging.

A comprehensive framework for reverse engineering compiled, obfuscated, packed, or virtualized targets. This process is crucial for understanding the internal workings of binaries, APKs, firmware, and custom VMs before exploitation or solution. It supports static and dynamic analysis using advanced tools like IDA, Ghidra, and angr, covering complex anti-analysis techniques and deep code structure analysis.

This skill provides a CLI-based workflow for Android APK reverse engineering. It covers APK unpacking, Java decompilation, smali modification, repackaging, Frida dynamic hooking, and optional native .so analysis. It leverages local tools such as jadx, apktool, frida, adb, ida-reverse, and radare2. Useful for analyzing login, signature, security, root detection, or certificate verification logic in Android apps, always in an authorized context.

Provides IDA Pro reverse engineering capabilities for analyzing binaries, PE/ELF/APK/DLL/SO files, firmware, and malware. Supports decompilation, password discovery, vulnerability analysis, and software cracking workflows. Uses deterministic scripts for HTTP server management and file opening to avoid known MCP schema and lock issues.

A comprehensive toolkit for Android APK reverse engineering, including unpacking, decompilation, smali modification, repacking, signing, and dynamic hooking with Frida. Supports native .so analysis and integrates tools like jadx, apktool, and adb for authorized security assessments.

Authorized Android/iOS reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.

A command-line interface skill for radare2, enabling binary reconnaissance, disassembly, analysis, function locating, and lightweight patching without a GUI. Supports various formats like exe, dll, elf, and apk. Ideal for scripting automation and quick terminal-based reverse engineering tasks using r2, rabin2, rasm2, and radiff2.