Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
설치
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
Static mobile app review for Android and iOS: APK/AAB/IPA/source analysis, manifest or plist or entitlements review, permissions, storage, crypto, network config, deep links, WebViews, secrets, and reverse-engineering-heavy checks. Use for offline package or source inspection and for mapping findings to MASVS and MASWE.
MOBILE STATIC
Offline review of Android and iOS apps.
Use this when you have an APK, AAB, IPA, extracted app files, or a mobile source tree.
Core Workflow
Work in this order unless the user asks for a narrower pass:
Fingerprint the artifact or codebase.
Unpack or decompile enough to inspect metadata and code.
Review app metadata and exposed entry points.
Check storage, crypto, network configuration, and local trust boundaries.
Hunt hardcoded secrets and backend clues.
Assess reverse-engineering friction and note whether it is only a resilience observation or part of a real exploit chain.
Keep notes short and map each real issue to MASVS and MASWE where possible.
