Guide · Agent skill
How to use the Mobile App Penetration Testing agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the conducting-mobile-app-penetration-test agent skill does, how to install it for Claude, and how to ask for a mobile app security test in plain language. It is for professional testers and developers who have written permission to test an app. By the end you will know how to install the skill, trigger it, and what tools and access you need before you start.
Mobile App Penetration Testingmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill as a ZIP file from this page. Keep the file somewhere you can find it.
- 2Install the skill. Unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. Alternatively, upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- 3Prepare your lab. Set up a rooted Android device or emulator, or a jailbroken iOS device or Corellium device, with Frida and Objection installed. Configure Burp Suite Professional as a proxy with its CA certificate on the test device.
- 4Confirm authorisation. Get written permission from the app owner and note the scope. The skill should not be used without it.
- 5Ask for the test in plain language. Name the platform, the app build, and the goal, such as a MASVS L1 check or a storage review. Mention that you have authorisation.
- 6Follow the workflow and record evidence. Run the commands the agent suggests, one stage at a time. Keep notes and output so each finding can be reproduced in your report.
What does this skill make the agent do?
The skill gives the agent a structured methodology for penetration testing iOS and Android apps, based on the OWASP Mobile Application Security Testing Guide (MASTG). It covers static analysis of app binaries, network interception, local data storage, authentication and session management, and runtime manipulation. It is organised around the OWASP MASVS levels L1 and L2 for compliance-style assessments.
The skill is a methodology and command reference, not a standalone scanner. The agent follows the steps and suggests commands for tools such as jadx, MobSF, Burp Suite, Frida and Objection, but you still run the tools and interpret the results.
- Static analysis: decompiling APKs with jadx and reviewing AndroidManifest.xml, or extracting IPAs and examining Mach-O binaries
- Network testing: proxying traffic through Burp Suite and checking certificate pinning
- Data storage checks: SharedPreferences, SQLite databases, Keychain, logs and backups
- Authentication checks: token storage, session timeouts, root or jailbreak detection, and deep links
- Runtime tests: Frida hooking and tampering detection
How do you install the skill?
Download the skill as a ZIP file from this page. Then add it to Claude using one of the two options below. Use the user-level folder if you want the skill available across all your projects, or the project folder if you want it limited to one codebase.
Option one is to unzip the download into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. Option two is to upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
- Check that the skill folder contains SKILL.md at its top level, along with references/api-reference.md and scripts/agent.py
How do you trigger the skill with a natural request?
You do not need a special command. The skill activates when your request involves a mobile app pentest, an iOS security assessment, Android security testing, or an OWASP MASTG assessment. State the platform, the app, and the authorisation, then describe the goal.
Be specific about scope. Say which app build you are testing, whether you have the IPA or APK, and whether you need a compliance check against MASVS L1 or L2, a full pentest, or a focused check such as storage or authentication.
- Example: Run an OWASP MASTG static analysis on this Android APK. I have written authorisation from the app owner.
- Example: Walk me through an iOS security assessment of our banking app's login and token storage.
- Example: Check whether our app meets MASVS L1 before release, and list gaps with evidence.
- Example: Help me test certificate pinning on this Android build with Frida and Burp Suite.
What tools and access do you need?
The skill assumes substantial tooling and expertise. Plan the lab before you start, because many steps cannot run without a device that you control and can instrument.
The skill's prerequisites list a rooted Android device or emulator, or a jailbroken iOS device or a Corellium virtual device. Burp Suite Professional needs its CA certificate installed on the test device. The bundled Python script uses the requests library and calls apktool and adb as subprocesses.
- Target IPA (iOS) and APK (Android) files, or access through a private distribution channel
- Static analysis: jadx, Hopper or Ghidra, and MobSF
- Dynamic analysis: Frida, Objection, Magisk (Android), and SSL Kill Switch (iOS)
- Burp Suite Professional configured as a proxy
- Python with the requests library for scripts/agent.py
python agent.py --apk target.apk --manifest AndroidManifest.xml --api-url https://api.target.com --auth-token <jwt> --output report.jsonWhat commands does the workflow use?
The skill walks through five stages. Each stage gives tool commands you can run yourself. The examples below come from the skill's workflow and show what the agent will suggest.
For Android, decompile the APK first and then review the manifest for exported components, permissions and the debuggable flag. For iOS, list linked frameworks in the binary and check Info.plist for App Transport Security exceptions. For runtime checks, attach Frida to the app while it runs.
- Decompile an APK with jadx to Java or Kotlin source
- List linked frameworks in an iOS binary with otool
- Use Frida for certificate pinning bypass on Android
- Use Objection on iOS to disable SSL pinning
- Test for tampering by modifying, re-signing and reinstalling the build
jadx -d output/ target.apkWhat are the safety notes?
This skill runs scripts and uses the network, so treat it like any other tool that touches live systems. Run it only in a lab or test environment, and only against apps you own or have written permission to test. The skill itself says unauthorised use is illegal in many places and may violate computer fraud laws.
The skill also prohibits distributing modified or repackaged apps. Its tampering tests are for checking whether the app detects changes during an authorised test, not for releasing altered builds. Do not test public store apps unless you have a separate test build from the owner.
- Get written authorisation from the application owner before any testing
- Test in an isolated lab with devices you control
- Do not distribute or repackage modified apps
- Do not test public app store builds without a separate test build
What people use it for
- Pre-release security testing of a mobile banking, healthcare or government app that handles sensitive data
- Developer checks of their own app against OWASP MASVS L1 or L2 before a release
- Consistent checklist for mobile pentest reports across a security team
- Reviewing an app's API traffic and certificate pinning during an authorised assessment
Frequently asked questions
Is the mobile app penetration testing skill free?
The source does not state pricing or licence fees for the skill beyond its licence, which is Apache-2.0. The tools it relies on, such as Burp Suite Professional, are separate products that you must obtain and license yourself.
What do I need to run the skill?
You need the target IPA or APK, a rooted Android device or emulator or a jailbroken iOS device or Corellium, and tools including jadx, Hopper or Ghidra, MobSF, Burp Suite Professional, Frida, Objection and SSL Kill Switch. The bundled script also needs Python with the requests library.
Is this an automated scanner I can run with one click?
No. The skill is a structured methodology with commands for specialist tools. It requires substantial tooling and expertise, and it is not a standalone scanner.
Does the skill work on both iOS and Android?
The SKILL.md covers both iOS and Android. The bundled API reference describes the agent script as testing Android applications, so check its scope before relying on it for iOS work.
How do I install an agent skill in Claude?
Download the ZIP and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder for one project. You can also upload the ZIP in the Claude apps under Settings → Capabilities → Skills.
How does this compare with MobSF or other scanners?
MobSF is an automated scanner that you run on uploaded files, while this skill guides an agent through a full manual methodology that uses MobSF as one step. The skill is better for structured reporting and expert-led tests, and a scanner alone is faster for quick checks.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a professional tester with written authorisation, or a developer checking your own app against OWASP MASVS L1 or L2 before release. Pick a different option if you want a one-click scanner or you lack the devices, tools and experience to run instrumented tests.
Download the skill