Mobile app assessment orchestrator for Android and iOS. Routes work by artifact type (APK/AAB, IPA, source tree, live app) and by mode (static or dynamic). Use when starting a general mobile security review, when the user has not chosen static vs dynamic yet, or when mobile testing needs handoff into web2-recon or bug-bounty for backend/API assessment.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Mobile app assessment orchestrator for Android and iOS. Routes work by artifact type (APK/AAB, IPA, source tree, live app) and by mode (static or dynamic). Use when starting a general mobile security review, when the user has not chosen static vs dynamic yet, or when mobile testing needs handoff into web2-recon or bug-bounty for backend/API assessment.
MOBILE
Start here for a general Android or iOS app assessment.
This skill is an orchestrator. It decides the path, keeps outputs structured, and hands off to the right focused skill.
Decide The Starting Point
Classify the target first:
APK or AAB -> Android static-first
IPA -> iOS static-first
source tree -> static-first
installed app with no package/source -> dynamic-first
Then choose the mode:
static when you need unpacking, decompilation, manifest/plist review, secrets, storage, crypto, deep links, entitlements, or reverse engineering
dynamic when you need live traffic, runtime hooks, pinning bypass, auth/session testing, WebViews, logs, or device behavior
If the user did not choose a mode, default to:
static-first for APK, AAB, IPA, or source
dynamic-first for a live installed app only
Route To The Right Skill
Use mobile-static for offline artifact or source inspection.
Use mobile-dynamic for runtime verification on device or emulator.
Use web2-recon when the mobile app reveals backend hosts, API paths, GraphQL endpoints, file upload flows, or web callbacks.
Use bug-bounty after recon when the goal shifts from mobile assessment into server-side bug hunting and impact validation.
Minimum Output Shape
Produce findings in a compact operator format:
Target: <app / package / bundle id>
Platform: android | ios
Mode: static | dynamic
Evidence: <file, screen, request, response, or runtime observation>
Issue: <plain-language finding>
MASVS: <control IDs>
MASWE: <weakness IDs if applicable>
Next step: <confirm dynamically / trace statically / hand off to web2-recon / validate in bug-bounty>
If nothing substantial is found, say so plainly and leave a short list of the highest-value next checks.
Reference Loading
Do not copy OWASP content into the answer. Load only the files needed for the current task.
Primary references:
Refrence/mastg/Document -> workflow and platform testing procedures
Refrence/maswe/weaknesses -> weakness naming and MASVS-linked mapping
Refrence/OWASP_MASVS.cdx.json -> MASVS control taxonomy
Refrence/OWASP_MAS_Checklist.xlsx -> checklist grouping and review flow
Secondary references:
Refrence/Learn-android-bug-bounty -> practical Android bug bounty commands, deep link discovery, MobSF usage, Drozer, Frida, and Objection notes
Refrence/skills -> reusable skill patterns and targeted follow-up references such as Firebase APK scanning and source-code static analysis
Handoff Rule
Do not duplicate the full web recon workflow here.
When mobile testing exposes backend behavior, pivot like this:
Extract hostnames, paths, headers, auth flows, and upload points from the app.
Use web2-recon to map the reachable backend surface.
Use bug-bounty to hunt and validate real server-side impact.
