Skill UI

Scans Android APKs for Firebase misconfigurations, testing databases, storage, authentication, and cloud functions to surface vulnerabilities during mobile security audits.

This expert specializes in secure mobile development practices, covering areas like input validation, WebView security, secure data storage (KeyStore/Keychain), and advanced network security (Certificate Pinning). Use this skill to write secure, resilient mobile code for both iOS and Android, mitigating platform-specific vulnerabilities and ensuring sensitive data protection.

This expert skill performs non-intrusive static analysis to thoroughly audit AI skills and bundles. It identifies malicious patterns, data leaks, system stability risks, and obfuscated payloads across major operating systems (Windows, macOS, Linux/Unix) and mobile platforms (Android/iOS). Use it when verifying skill legitimacy or performing deep cross-platform security reviews.

A comprehensive tool for performing static analysis on Android APK malware samples. It utilizes androguard, apktool, and jadx to detect dangerous permission combinations, suspicious API calls (like reflection or crypto), dynamic code loading patterns, and extract Indicators of Compromise (IOCs) for robust security incident response and threat hunting.

A comprehensive guide for conducting penetration testing on iOS and Android mobile applications, adhering to the OWASP MASTG. This skill covers the full mobile attack surface, including static analysis of binaries, dynamic runtime testing, and deep API security assessment. Techniques taught include bypassing certificate pinning, analyzing local data storage (Keychain, SQLite), and identifying vulnerabilities in authentication and network communication.

A comprehensive skill designed for advanced security analysis, detecting malicious behaviors across mobile applications (Android/iOS). It performs multi-layered analysis, including static indicator checks (permissions, manifest), dynamic instrumentation via Frida, network traffic monitoring (C2 communication, exfiltration), and automated scanning (MobSF). Use this when investigating suspicious apps, detecting trojans, or performing malware triage.

A comprehensive skill for assessing mobile applications (Android and iOS) for vulnerabilities related to deep links, custom URI schemes, and intent handling. This skill identifies risks such as unauthorized access, data injection, intent hijacking, and improper validation of App Links or Universal Links, crucial for robust mobile security testing.

A comprehensive guide for intercepting and analyzing HTTP/HTTPS traffic from mobile applications using Burp Suite. This skill walks through configuring proxies on Android and iOS, handling CA certificate installation, and executing advanced penetration testing techniques. It is essential for assessing API security, identifying data leakage, and finding authentication vulnerabilities in mobile client-server communications.

Automates the static security analysis of Android APK/AAB files using the Mobile Security Framework (MobSF). This skill identifies critical vulnerabilities such as hardcoded secrets, insecure permissions, weak cryptography, and structural flaws (mapping to OWASP Mobile Top 10) without requiring application execution. It is essential for integrating security gates into CI/CD pipelines, performing pre-release quality assurance, and enhancing penetration testing coverage.

This skill enables sophisticated runtime dynamic analysis of Android applications using industry-standard tools like Frida and Objection. It is used to observe application behavior, intercept API calls, monitor network traffic, and bypass client-side security protections (e.g., root detection, anti-debugging). Essential for identifying vulnerabilities and analyzing obfuscated code that static analysis cannot reach.

This skill provides advanced techniques for bypassing SSL/TLS certificate pinning in Android and iOS applications. It supports interception of HTTPS traffic during authorized security assessments, covering pinning mechanisms like OkHttp, TrustManager, NSURLSession, and utilizes tools such as Frida and Objection for comprehensive testing.

A comprehensive guide for reverse engineering Android malware. It details how to use JADX and accompanying tools (apktool, androguard) to analyze APK metadata, extract permissions, decompile Java/Kotlin source code, and identify malicious functionalities like data exfiltration, C2 communication, and overlay attacks. Ideal for mobile threat analysis and security research.