Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
Installation
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
MOBILE STATIC
Offline review of Android and iOS apps.
Use this when you have an APK, AAB, IPA, extracted app files, or a mobile source tree.
Core Workflow
Work in this order unless the user asks for a narrower pass:
Fingerprint the artifact or codebase.
Unpack or decompile enough to inspect metadata and code.
Review app metadata and exposed entry points.
Check storage, crypto, network configuration, and local trust boundaries.
Hunt hardcoded secrets and backend clues.
Assess reverse-engineering friction and note whether it is only a resilience observation or part of a real exploit chain.
Keep notes short and map each real issue to MASVS and MASWE where possible.
