Guide · Agent skill
How to use the Mobile App Pentest Methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-mobile skill is a written playbook that teaches an AI agent how to security-test Android and iOS apps. Once installed, it guides the agent through decompiling an app, looking for hardcoded secrets and exposed endpoints, hooking running code with Frida, and probing exported components, deep links, storage and WebViews. This guide explains what the skill does, how to install it, how to ask for it, and the safety limits you need to respect.
Mobile App Pentest MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download and unzip. Download the ZIP from the skill page on this site and unzip it. Confirm that SKILL.md sits inside the offensive-mobile folder.
- 2Place the skill folder. Copy the folder to ~/.claude/skills/ for personal use, or to the project's .claude/skills/ folder for one project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare your tools. Install apktool, jadx, Frida and Objection. For dynamic testing, prepare a rooted Android or jailbroken iOS device that you are authorised to test.
- 4Get written authorisation. Confirm in writing that you may test the target app. The skill's techniques can be illegal or harmful against apps you have no permission to test.
- 5Ask a clear question. Describe the platform, the files you have and the goal, for example a static review of an APK for hardcoded secrets.
- 6Work through the workflow. Follow the agent through static analysis, dynamic hooks, attack surface mapping and storage review. Verify each lead yourself before reporting it.
What the offensive-mobile skill makes the agent do
An agent skill is a folder containing a SKILL.md file with instructions the agent reads when a request matches the skill's description. This skill covers mobile application penetration testing for both Android and iOS. Its file is mostly reference commands and techniques rather than executable code.
The skill sets out a five-step quick workflow: static analysis, dynamic analysis on a rooted or jailbroken device, mapping the exported attack surface, auditing storage and Keystore or Keychain use, and testing every backend the app talks to as you would a web app.
- Static analysis: pull the app package, decompile it, dump strings and identify endpoints
- Dynamic analysis: install on a rooted or jailbroken device, hook with Frida, intercept TLS
- Attack surface: deep links, URL schemes and exported components
- Storage audit: where secrets live and what protects them
- API testing: the backends the app calls
Install the offensive-mobile skill
Download the ZIP from the skill page on this site and unzip it. You can install it for yourself or for a single project. For a personal install, place the unzipped skill folder in ~/.claude/skills/. For a project-only install, place it in the project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there. The skill's only file is SKILL.md, so check that it sits inside the skill folder after unzipping.
- Personal: ~/.claude/skills/
- Single project: the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload
ls ~/.claude/skills/offensive-mobileSet up the tools the skill expects
The skill assumes you have the tools it names. Required: apktool, jadx, Frida and Objection, plus a rooted Android device or jailbroken iOS device for dynamic testing. Burp Suite or Mitmproxy and drozer are optional but referenced in the examples.
The file also describes lab setup, including Magisk for systemless root on Android and an SSH connection over USB to a jailbroken iOS device. Treat those as the skill's suggestions and check the current documentation for each tool before you rely on it.
- Required: apktool, jadx, Frida, Objection
- Dynamic testing: rooted Android or jailbroken iOS device
- Optional: Burp Suite or Mitmproxy, drozer
How to trigger the skill with natural requests
You do not need special syntax. Ask about mobile penetration testing in plain language and mention the platform and the goal. The skill is written for mobile pentests, bug bounty mobile triage and app-store reconnaissance, so those phrases match its purpose well.
Be specific about what you have. Say whether you have the APK or IPA, whether the device is rooted or jailbroken, and what you want to find. The more context you give, the more targeted the agent's workflow can be.
- Walk me through a static analysis of this APK for hardcoded secrets and exposed endpoints.
- I have written authorisation to test this iOS app. Help me plan SSL pinning bypass with Frida.
- Check the manifest for exported activities and debuggable flags in this Android app.
- Triage this bug bounty target's mobile app for insecure storage in the Keychain.
Worked example: static review of an Android app
For static analysis of an Android app, the skill uses apktool to decode resources and smali, and jadx to decompile to Java. It then reviews AndroidManifest.xml for exported components, intent filters, debuggable and allowBackup settings and networkSecurityConfig.
The skill also suggests searching decompiled source for URLs and key-like strings, and for leftover debug log calls. Expect the agent to report these as leads to verify, not confirmed vulnerabilities.
- Decode: apktool d app.apk -o app
- Decompile: jadx -d app_src app.apk
- Search for secrets and endpoints in app_src/
- Check for leftover Log.d, Log.w and similar calls
apktool d app.apk -o appSafety, scope and what the skill does not do
The skill's own file lists no scripts and no network use, so the skill itself does not run code or scan anything. The commands it describes do act on real apps and devices, and some Frida hooks and iOS commands alter app behaviour at runtime. Only use it on apps you own or have written authorisation to test.
The skill gives methodology and commands, not an automated scanner. A non-expert expecting a one-click result will be disappointed, and the findings still need manual validation.
- Only test apps you own or have written permission to test
- Runtime hooks change how a running app behaves; use a test device
- Expect to verify each lead manually
- Review every command before running it on a device
What people use it for
- Preparing a mobile pentest by decompiling an APK and listing exported Android components
- Bug bounty triage of an iOS app, checking Info.plist for URL schemes and ATS exceptions
- Auditing your own app before release for hardcoded secrets and debug logging
- Learning how Android WebView JavaScript bridges and iOS Keychain settings are assessed
Frequently asked questions
Is the offensive-mobile skill free to use?
The skill is published under the MIT licence, as stated on its page. Check the licence file in the source repository for the full terms before you reuse or redistribute it.
What do I need before I install it?
You need an agent that supports skills, such as Claude, and the ZIP from the skill page. For real testing you also need apktool, jadx, Frida and Objection, plus a rooted Android or jailbroken iOS device.
Where do I put the skill folder?
Use ~/.claude/skills/ for a personal install or the project's .claude/skills/ folder for one project. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Does the skill scan apps automatically?
No. The skill is methodology and command reference, not an automated scanner. It describes steps and tools, and you or the agent still have to run and interpret them.
How does it compare to a tool like MobSF or an automated scanner?
This skill guides a manual, structured workflow with commands for Frida, Objection and decompilers. Automated scanners give faster first-pass results, while this skill suits people who want to understand and drive each step.
Why does the agent say it cannot find my device or tools?
The skill expects apktool, jadx, Frida, Objection and a rooted or jailbroken device to be installed and reachable. Check each tool is on your path and that the device is authorised and connected before retrying.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Security professionals preparing a mobile pentest, bug bounty triagers and students learning mobile attack surfaces will get a clear, structured playbook from this skill. Developers auditing their own apps will find it useful too. If you want a turnkey scanner or you have no authorisation to test the target, pick a different tool or get permission first.
Download the skill