17-mobile-security
starsforks
How to install 17-mobile-security?
masriyan/claude-code-cybersecurity-skill/17-mobile-security
$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 17-mobile-securityAndroid and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
SKILL.md
| 1 | # Mobile Application Security |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | Enable Claude to assess Android and iOS application security against the **OWASP MASVS** (Mobile Application Security Verification Standard) and execute tests from the **OWASP MASTG** (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps. |
| 6 | |
| 7 | > **Authorization Required**: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding. |
| 8 | |
| 9 | --- |
| 10 | |
| 11 | ## Activation Triggers |
| 12 | |
| 13 | This skill activates when the user asks about: |
| 14 | - Android (APK/AAB) or iOS (IPA) application security testing |
| 15 | - OWASP MASVS / MASTG verification or a mobile pentest checklist |
| 16 | - Decompiling, reversing, or static analysis of a mobile app |
| 17 | - Insecure data storage, hardcoded secrets, or keystore/keychain review |
| 18 | - Certificate pinning, SSL bypass, or mobile TLS/transport security |
| 19 | - Frida / objection dynamic instrumentation or runtime hooking |
| 20 | - `AndroidManifest.xml`, exported components, deep links, or `Info.plist` review |
| 21 | - Mobile malware analysis or suspicious APK triage |
| 22 | - Root/jailbreak detection, tampering, or anti-RE controls |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | ## Prerequisites |
| 27 | |
| 28 | ```bash |
| 29 | pip install requests pyaxmlparser |
| 30 | ``` |
| 31 | |
| 32 | **Optional enhanced capabilities:** |
| 33 | - `apktool` — APK decode/rebuild |
| 34 | - `jadx` — Dalvik → Java decompiler |
| 35 | - `apkid` — packer/obfuscator/compiler fingerprinting |
| 36 | - `frida` / `objection` — dynamic instrumentation |
| 37 | - `mobsf` (MobSF) — automated static+dynamic analysis platform |
| 38 | - Android SDK platform-tools (`adb`), `unzip`, `openssl` |
| 39 | |
| 40 | --- |
| 41 | |
| 42 | ## Core Capabilities |
| 43 | |
| 44 | ### 1. APK Static Analysis |
| 45 | |
| 46 | When asked to analyze an APK: |
| 47 | 1. **Unpack & decode** — `apktool d app.apk`; extract `AndroidManifest.xml`, `classes*.dex`, `resources.arsc`, native libs (`lib/`), and assets. |
| 48 | 2. **Manifest review** — flag: |
| 49 | - `android:debuggable="true"`, `android:allowBackup="true"` |
| 50 | - Exported components (`activity`/`service`/`receiver`/`provider` with `exported="true"` or implicit via intent-filter) lacking permissions |
| 51 | - `usesCleartextTraffic="true"` / permissive `network_security_config` |
| 52 | - Dangerous/excessive permissions; custom permissions with weak `protectionLevel` |
| 53 | - Deep links / `android:autoVerify` (app-link hijack), exported `ContentProvider` paths |
| 54 | 3. **Secret hunting** — scan decompiled sources/resources/assets for API keys, tokens, private keys, cloud creds, hardcoded crypto keys/IVs, and backend URLs. |
| 55 | 4. **Decompile** — `jadx` to Java; review auth, crypto, WebView (`addJavascriptInterface`, `setJavaScriptEnabled`, `loadUrl` with untrusted input), and SQL. |
| 56 | 5. **Native & packing** — `apkid` for packers/obfuscators; inspect `lib/*/*.so` for JNI entry points and hardcoded data. |
| 57 | 6. **Signature** — verify signing scheme (v1/v2/v3), debug-cert use, and integrity. |
| 58 | |
| 59 | Use `scripts/apk_analyzer.py` for an automated first pass. |
| 60 | |
| 61 | ### 2. iOS (IPA) Static Analysis |
| 62 | |
| 63 | When asked to analyze an IPA: |
| 64 | 1. Unzip the IPA; locate `Payload/<App>.app/`. |
| 65 | 2. **`Info.plist`** — `NSAppTransportSecurity` exceptions (`NSAllowsArbitraryLoads`), URL schemes, `UIFileSharingEnabled`, permission usage strings. |
| 66 | 3. **Binary checks** — encryption (`cryptid`), PIE, stack canaries, ARC; detect missing hardening via `otool`/`class-dump`. |
| 67 | 4. **Secret hunting** — `strings` and resource scan for keys, endpoints, tokens. |
| 68 | 5. **Data storage** — `NSUserDefaults`, Core Data, Keychain accessibility classes (avoid `kSecAttrAccessibleAlways`), plist data at rest. |
| 69 | 6. **Embedded provisioning profile** — entitlements, ad-hoc vs. enterprise distribution. |
| 70 | |
| 71 | ### 3. Insecure Data Storage (MASVS-STORAGE) |
| 72 | |
| 73 | Review where sensitive data lands at rest: |
| 74 | - Android: SharedPreferences, SQLite, internal/external files, logs, WebView cache, clipboard. Verify Keystore-backed keys for sensitive material. |
| 75 | - iOS: Keychain (correct accessibility), no secrets in NSUserDefaults/plists, no sensitive data in app snapshots/backups. |
| 76 | - Flag any PII, tokens, or credentials stored plaintext or with app-derived keys. |
| 77 | |
| 78 | ### 4. Network & Transport (MASVS-NETWORK) |
| 79 | |
| 80 | - Confirm TLS everywhere; no cleartext fallback. |
| 81 | - **Certificate/public-key pinning** present and validated; document bypass via objection/Frida for testing. |
| 82 | - Inspect API traffic with an intercepting proxy (Burp/mitmproxy); test for the same API flaws as web (→ Skill 09): IDOR, broken auth, mass assignment. |
| 83 | |
| 84 | ### 5. Dynamic Analysis & Instru |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
