How to use the Mobile App Reverse Engineering agent skill

What does the mobile-reverse skill make the agent do?

An agent skill is a folder of instructions (a SKILL.md file plus reference documents) that an AI agent loads when a task matches the skill's description. This one covers authorized Android and iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.

The skill organizes the work into four phases: information gathering (app files, manifest or Info.plist analysis, hardcoded secret scanning), static analysis (decompiling code and binaries), dynamic analysis (hooking running apps with Frida and Objection), and network analysis (intercepting traffic with Burp Suite or mitmproxy). It also includes ready-made snippets for bypassing SSL pinning, root and jailbreak detection, and anti-debugging, and examples for extracting encryption keys at runtime.

How do you install the mobile-reverse skill?

Download the ZIP for the mobile-reverse skill from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. To limit it to one project, place it in that project's .claude/skills/ folder instead.

You can also upload the skill in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with a natural request?

You do not need a special command. Describe an authorized mobile security task in plain language and mention the platform and the goal. The agent checks whether the task matches the skill's description before using it.

State the authorization context in your request, for example that the app is yours or that you have written permission to test it. The skill itself contains no authorization check, so the agent relies on what you tell it and on your own process.

• Analyze this APK for hardcoded API keys and exported components. I own this app.
• Help me set up Frida and Objection to test SSL pinning on my Android test build.
• Walk me through static analysis of this IPA's Mach-O binary with otool and class-dump. We have written permission to test it.
• Check whether my app's root detection holds up on a rooted test device.

What do you need before you start?

The skill expects a working toolchain. It names Python tooling and CLI tools such as androguard, APKLeaks, JADX, apktool, Ghidra, class-dump, otool and jtool2, plus Frida, Objection, and frida-ios-dump or Clutch for iOS decryption. For network interception it uses Burp Suite or mitmproxy. Many dynamic steps require a rooted or jailbroken device, or a repackaged APK with Frida Gadget. You also need access to the target app binary, from Google Play, APKMirror, App Store tools, or adb.

The skill's SKILL.md tells the agent to check tool availability against a tool index and to bootstrap missing tools rather than guess paths. Your environment must allow the agent to run scripts and use the network.

• Python tooling and CLI tools (androguard, APKLeaks, JADX, apktool, Ghidra, class-dump, otool, jtool2)
• Frida, Objection, frida-ios-dump or Clutch
• Burp Suite or mitmproxy
• Rooted or jailbroken device, or repackaged APK with Frida Gadget, for many dynamic steps

What safety points should you know?

This skill runs scripts and uses the network. Several steps, such as patching APKs, re-signing, and installing hooks, can alter or break an app on a device. Test on devices and builds you control, and keep backups.

Use it only on apps you own or have written permission to test. Bypassing protections in others' apps can be illegal, and modifying an app's features or removing paywalls is outside what the skill covers and may violate terms of service or law.

• Work only on apps you own or have written authorization to test.
• Use a test device or lab environment, not a personal phone with important data.
• Review every script the agent runs before it executes, especially network-facing steps.
• Expect that patching and re-signing can break an app.

What tips help you get better results?

Follow the methodology the skill is built on: OWASP MASTG. Ask for one phase at a time (for example, static analysis first) so you can check the output before moving on. Keep your own record of commands and screenshots, since the skill's checklist expects reproducible evidence.

For SSL pinning and root detection, the skill's reference notes describe layered detection (static checks, runtime checks, environment checks). Ask the agent to test one layer at a time so you can see which check your app relies on.

• Name the platform (Android or iOS) and the app's package name or bundle ID.
• Ask for one phase at a time and review results before continuing.
• Save commands and outputs as evidence for your test report.
• Use your own or permitted test builds for every experiment.