Skill UI

A comprehensive checklist detailing advanced attack methodologies for JSON Web Tokens (JWT). Covers critical misconfigurations such as algorithm confusion (alg:none, RS256→HS256), weak secret brute forcing, header injection (kid, jku, jwk), cache poisoning, and improper validation. Also provides specific vectors for extracting JWTs from mobile environments (Android/iOS). Ideal for penetration testers conducting deep security assessments on authentication systems.

A practical offensive methodology for Android and iOS app testing. It covers static analysis, Frida/Objection instrumentation, SSL pinning bypass, exported component abuse, insecure storage review, and mobile API reconnaissance for pentest and bug bounty work.

A comprehensive playbook for expert-level Android application security testing. It covers advanced exploitation techniques, including SSL pinning bypass (using Frida/Objection), detecting component exposure (activities, providers, services), and exploiting WebView vulnerabilities (RCE, XSS). Essential for authorized mobile penetration testing assessments.

A comprehensive playbook for API reconnaissance and documentation review. Use this skill early in the testing process to enumerate all reachable endpoints, extract schemas, identify hidden versions (e.g., v1, v2, mobile), and discover undocumented parameters or fields across REST, GraphQL, and mobile APIs. Essential for mapping the full attack surface before deeper exploitation.

A comprehensive playbook for advanced mobile security assessments of iOS applications. Covers both jailbroken and non-jailbroken environments, focusing on critical attack vectors such as keychain extraction, URL scheme hijacking, Universal Links exploitation via AASA misconfigurations, runtime memory manipulation (Frida/Objection), and binary protection analysis.

This skill generates robust, production-grade Appium automation scripts for both Android and iOS. It supports multiple languages (Java, Python, JavaScript) and guides users through best practices for cross-platform testing, including proper locator strategies, explicit waiting, and complex gestures. Ideal for automating mobile QA processes on local emulators or cloud real device farms.

Provides a comprehensive methodology for evaluating mobile computing systems. It mandates rigorous, real-device testing, focusing on instrumenting energy consumption, thermal behavior, latency distribution (tails), and memory limits. This guide ensures academic submissions are credible, repeatable, and compare performance against robust, tuned baselines.

A comprehensive methodology for deep security testing of both Android (APK) and iOS (IPA) applications. This guide covers the entire workflow, from initial information gathering and static analysis (decompilation, code structure analysis) to advanced dynamic instrumentation, network interception, and bypassing modern security measures like SSL Pinning, Root/Jailbreak detection, and anti-debugging.

Control Android and iOS devices, emulators, and simulators to launch apps, tap, swipe, type, take screenshots, and read accessibility trees. Ideal for mobile UI testing, app debugging, and reproducing phone bugs.

MobileBuildMCP provides tools for iOS, macOS, watchOS, tvOS, and visionOS development, including building, testing, running, debugging, logging, and UI automation. Use it to streamline Apple platform workflows.

Create, edit, validate, and run Agent QA tests, suites, and hooks via MCP or CLI while preserving canonical IDs and schema contracts. Supports web and mobile testing with strict ID validation and safe execution.

A comprehensive, end-to-end workflow bundle guiding developers through the entire software development lifecycle. It covers project scaffolding, frontend development (React/Next.js), robust backend architecture, database design, rigorous testing (TDD, E2E), code quality review, and modern CI/CD deployment practices for web and mobile applications.