cyber-performing-android-app-static-analysis-with-mobsf

name	cyber-performing-android-app-static-analysis-with-mobsf
description	Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD secu
source	mukul975/Anthropic-Cybersecurity-Skills
license	Apache-2.0
authorized_lab	false
origin_frontmatter	name: performing-android-app-static-analysis-with-mobsf | description: 'Performs automated static analysis of Android applications using Mobile | Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, | vulnerable components, weak cryptography, and code-level security flaws without | executing the application. Use when assessing Android APK/AAB files for security | vulnerabilities before deployment, during penetration testing, or as part of CI/CD | security gat
hide	true

Defensive/analysis cyber skill. Source: mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.

Performing Android App Static Analysis with MobSF

When to Use

Use this skill when:

• Conducting security assessment of Android APK or AAB files before production release
• Integrating automated mobile security scanning into CI/CD pipelines
• Performing initial triage of Android applications during penetration testing engagements
• Reviewing third-party Android applications for supply chain security risks

Do not use this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws.

Prerequisites

• MobSF v4.x installed via Docker (docker pull opensecurity/mobile-security-framework-mobsf) or local setup
• Target Android APK, AAB, or source code ZIP
• Python 3.10+ for MobSF REST API integration
• JADX decompiler (bundled with MobSF) for Java/Kotlin source recovery
• Network access to MobSF web interface (default: http://localhost:8000)

Workflow

Step 1: Deploy MobSF and Obtain API Key

Launch MobSF using Docker for isolated, reproducible scanning:

docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

Retrieve the REST API key from the MobSF web interface at http://localhost:8000/api_docs or from the startup console output. The API key enables programmatic scanning.

Step 2: Upload APK for Static Analysis

Upload the target APK using the MobSF REST API:

curl -F "file=@target_app.apk" http://localhost:8000/api/v1/upload \
  -H "Authorization: <API_KEY>"

Response includes the hash identifier used for subsequent API calls. MobSF automatically decompiles the APK using JADX, extracts the AndroidManifest.xml, and indexes all resources.

Step 3: Trigger and Retrieve Static Scan Results

Initiate the static scan and retrieve results:

# Trigger scan
curl -X POST http://localhost:8000/api/v1/scan \
  -H "Authorization: <API_KEY>" \
  -d 


curl -X POST http://localhost:8000/api/v1/report_json \
  -H  \
  -d