skilld
All skills
hardw00t avatar

/android-pentest

@f9bb3b2
by Hardik Mehtahardw00t/ai-security-arsenal104 stars
15

Comprehensive Android mobile application penetration testing with rooted-device ADB and Frida-based MCP tooling. Covers OWASP MASTG full methodology: recon, static + dynamic analysis, SSL/root bypass, IPC fuzzing, data exfiltration, crypto audit, and reporting. Triggers on requests to pentest Android apps, analyze APKs, bypass mobile security controls, or run MASVS/MASTG assessments.

Ask your Agent

Use this Skill: https://skilld.dev/gh/hardw00t/ai-security-arsenal/android-pentest

This session only. Nothing lands on disk.

examplesdata_storage_investigation.md

≈326 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Example: Data Storage Investigation

Goal: enumerate sensitive data the app persists locally.

Tool-call blueprint

prefs    = dump_shared_prefs("com.megabank.mobile")
dbs      = dump_databases("com.megabank.mobile")
internal = dump_internal_storage("com.megabank.mobile")
external = dump_external_storage("com.megabank.mobile")
logs     = get_logcat("com.megabank.mobile")

Findings template (populate per hit)

Artifact Sensitive content Severity MASTG
auth_prefs.xml auth_token, refresh_token, pin_hash plaintext HIGH MASTG-TEST-0001
app_data.db accounts (account#, balance), transactions, cached_credentials HIGH MASTG-TEST-0001
/files/user_profile.json name, email, phone, ssn_last_4 MEDIUM MASTG-TEST-0002
/Android/data/.../exports/statements_*.pdf world-readable statements MEDIUM MASTG-TEST-0003

Evidence required per finding

  • File path, byte size, exact plaintext snippet (redacted as needed)
  • package_name, device_id, capture timestamp
  • Copy of the file into the evidence bundle under evidence/data_storage/

Follow-ups

  • If DB is SQLCipher-encrypted: see workflows/data_exfiltration.md §6
  • If allowBackup=true: run adb backup -apk -noshared com.megabank.mobile

Source: SKILL.md on GitHub

Third-party checks

1 warning16d4 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides a comprehensive environment and automated workflows for Android mobile application penetration testing. It interfaces with standard industry tools like ADB and Frida to perform security audits aligned with the OWASP MASTG methodology. While it performs sensitive operations like command execution and remote tool downloads, these are transparently implemented for its stated purpose using trusted sources.

  • Socket16d

    21 alerts: gptSecurity, gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • ZeroLeaks5mo

    2 findings · Score: 80/100

Provenance

Signed by skilld at f9bb3b2. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 6 months ago

README badge

README badge for hardw00t/ai-security-arsenal/android-pentest