菜单
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments
Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting
Proof-of-concept development, payload crafting, shellcode analysis, and exploitation technique research for authorized security testing
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification
IOC extraction, threat intelligence correlation, MITRE ATT&CK mapping, hunt hypothesis generation, and detection rule creation
| name | Mobile Application Security |
| description | Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments |
| version | 3.0.0 |
| author | Masriyan |
| tags | ["cybersecurity","mobile-security","android","ios","masvs","mastg","apk","ipa","frida","reverse-engineering"] |
Enable Claude to assess Android and iOS application security against the OWASP MASVS (Mobile Application Security Verification Standard) and execute tests from the OWASP MASTG (Mobile Application Security Testing Guide). Claude performs static analysis on APK/IPA artifacts, guides dynamic instrumentation (Frida/objection), reviews secure storage, transport, and platform-interaction controls, and triages potentially malicious mobile apps.
Authorization Required: Only test applications you own or are explicitly authorized to assess. Decompiling and modifying third-party apps may violate licenses and law. Confirm written scope before proceeding.
This skill activates when the user asks about:
AndroidManifest.xml, exported components, deep links, or Info.plist reviewpip install requests pyaxmlparser
Optional enhanced capabilities:
apktool — APK decode/rebuildjadx — Dalvik → Java decompilerapkid — packer/obfuscator/compiler fingerprintingfrida / objection — dynamic instrumentationmobsf (MobSF) — automated static+dynamic analysis platformadb), unzip, opensslWhen asked to analyze an APK:
apktool d app.apk; extract AndroidManifest.xml, classes*.dex, resources.arsc, native libs (lib/), and assets.android:debuggable="true", android:allowBackup="true"activity/service/receiver/provider with exported="true" or implicit via intent-filter) lacking permissionsusesCleartextTraffic="true" / permissive network_security_configprotectionLevelandroid:autoVerify (app-link hijack), exported ContentProvider pathsjadx to Java; review auth, crypto, WebView (addJavascriptInterface, setJavaScriptEnabled, loadUrl with untrusted input), and SQL.apkid for packers/obfuscators; inspect lib/*/*.so for JNI entry points and hardcoded data.Use scripts/apk_analyzer.py for an automated first pass.
When asked to analyze an IPA:
Payload/<App>.app/.Info.plist — NSAppTransportSecurity exceptions (NSAllowsArbitraryLoads), URL schemes, UIFileSharingEnabled, permission usage strings.cryptid), PIE, stack canaries, ARC; detect missing hardening via otool/class-dump.strings and resource scan for keys, endpoints, tokens.NSUserDefaults, Core Data, Keychain accessibility classes (avoid kSecAttrAccessibleAlways), plist data at rest.Review where sensitive data lands at rest:
Guide runtime testing on a rooted/jailbroken test device or emulator:
android sslpinning disable, android root disable, keystore/keychain dump, list activities, start exported components.ContentProvider permissions, custom URL schemes / deep-link validation.For suspicious APKs: apkid packing, requested permissions vs. stated function, accessibility-service abuse, SMS/dialer/overlay permissions (banking-trojan markers), C2 URLs in strings, dynamic code loading (DexClassLoader). Hand confirmed IOCs to → Skill 06, deeper RE to → Skill 04/05.
# Mobile App Security Assessment — [App / Package]
Date: [Date] | Platform: [Android/iOS] | Version: [x.y.z] | Analyst: [Name]
## Executive Summary
[Posture, count by severity, top risks]
## MASVS Coverage
| Category | Result | Notes |
|----------|--------|-------|
| STORAGE | Fail | Token in SharedPreferences plaintext |
| CRYPTO | Pass | ... |
| NETWORK | Partial | No pinning |
| PLATFORM | ... |
| CODE / RESILIENCE | ... |
## Findings
### [M-01] Hardcoded API Key in resources (High)
- MASTG-TEST ref / MASVS-STORAGE
- Evidence: res/values/strings.xml:api_key=...
- Impact / Remediation: [rotate, move to backend, ...]
## Recommendations (Prioritized)
apk_analyzer.py# Static triage of an APK: manifest flags, permissions, exported components, secrets
python scripts/apk_analyzer.py --apk app.apk --output apk_report.json
# Secret-scan the decoded sources too (point at an apktool/jadx output dir)
python scripts/apk_analyzer.py --apk app.apk --sources ./jadx_out --output apk_report.json
| Next Step | Condition | Target Skill |
|---|---|---|
| Backend API testing | App talks to REST/GraphQL API | → Skill 09 |
| Deeper native/binary RE | .so / obfuscated logic | → Skill 04 |
| Malware classification | Suspicious/packed APK | → Skill 05 |
| IOC correlation | C2 / malicious infra found | → Skill 06 |
| Crypto implementation review | Custom crypto in app | → Skill 13 |