Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
MOBILE STATIC
Offline review of Android and iOS apps.
Use this when you have an APK, AAB, IPA, extracted app files, or a mobile source tree.
Core Workflow
Work in this order unless the user asks for a narrower pass:
Fingerprint the artifact or codebase.
Unpack or decompile enough to inspect metadata and code.
Review app metadata and exposed entry points.
Check storage, crypto, network configuration, and local trust boundaries.
Hunt hardcoded secrets and backend clues.
Assess reverse-engineering friction and note whether it is only a resilience observation or part of a real exploit chain.
Keep notes short and map each real issue to MASVS and MASWE where possible.
