Mobile App Pentest Methodology
Guides an agent through Android and iOS app security testing, from static analysis to Frida hooking.
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This is a written playbook that teaches an AI agent how to security-test mobile apps for Android and iOS. Once installed, when asked about mobile penetration testing, the agent follows a structured workflow: decompile the app, look for hardcoded secrets and exposed endpoints, hook running code with Frida, test SSL pinning and root or jailbreak checks, and probe exported components, deep links, insecure storage and WebViews. The file is mostly reference commands and techniques rather than executable code.
Great for
- Security professionals preparing a mobile pentest or bug bounty triage
- Students learning how mobile app attack surfaces are assessed
- Developers wanting to audit their own apps before release
Skip it if
- Testing apps you do not own or have written authorisation to test, since the techniques target real apps and could be illegal or harmful to use without permission
- Non-technical users expecting a turnkey scanner; the skill gives methodology and commands, not an automated tool
Try asking
- “Walk me through a static analysis of an Android APK to find exported activities and hardcoded API keys.”
- “Outline how I would test an iOS app's SSL pinning and jailbreak detection on a test device I own.”
- “Create a checklist for auditing insecure data storage in an Android app I'm assessing under a signed scope.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-mobile.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-mobile.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-mobile.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use it against apps you are authorised to test, and state the scope in your request.
- The agent will suggest commands; review each one before running it on a device or target.
- Ask for one phase at a time (static, then dynamic) to keep findings organised.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.