Skip to content
Get packs

Mobile App Penetration Testing

Guides an agent through OWASP MASTG-based security testing of iOS and Android apps

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a structured methodology for security testing iOS and Android apps: analysing app binaries, intercepting network traffic, checking local data storage, and testing authentication and runtime protections, using the OWASP MASTG framework. It gives step-by-step commands for tools such as jadx, MobSF, Burp Suite, Frida and Objection. It is meant for professional testers working with written permission and is not a standalone scanner.

Great for

  • Security testers preparing an authorised assessment of a mobile banking, healthcare or government app
  • App developers checking their own app against OWASP MASVS L1/L2 before release
  • Security teams wanting a consistent checklist for mobile pentest reports

Skip it if

  • Testing apps you do not own or lack written permission to test, which is illegal in most jurisdictions
  • Anyone wanting to repackage or distribute modified apps, which the skill itself prohibits
  • Beginners expecting an automated one-click scanner; it requires substantial tooling and expertise

Try asking

  • “Walk me through a static analysis of this Android APK for hardcoded secrets and exported components, with written authorisation from the owner”
  • “Create a checklist for testing certificate pinning and token storage in our iOS banking app”
  • “Help me plan an OWASP MASVS L1 assessment of our mobile app before release”
Step-by-step guide: how to use Mobile App Penetration TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-mobile-app-penetration-test.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-mobile-app-penetration-test.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-mobile-app-penetration-test.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use against apps you have written authorisation to test, and keep a scope document with the client
  • Run the tooling in an isolated lab environment with test builds rather than production devices or live accounts
  • Review scripts/agent.py before running it; it calls apktool and strings through subprocess and uses requests, and its sensitive-pattern extraction is a basic keyword search

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.