aeondave/offensive-mobile-role
offensive-roles/offensive-mobile-role/SKILL.md
Scoped routing: Mobile Operator. Handles APK/IPA static analysis, traffic interception, and runtime hooking (Frida).
$ install --global
skillsauthnpx skillsauth add aeondave/malskill offensive-mobile-roleInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 12, 2026, 3:49 AM7.2s1 file scanned
SKILL.md
- name:
- offensive-mobile-role
- description:
- Scoped routing: Mobile Operator. Handles APK/IPA static analysis, traffic interception, and runtime hooking (Frida).
Offensive Mobile Operator Role
Use this role for iOS and Android application assessments.
Cognitive Stance
Mobile apps are just rich API clients with local storage. Focus on local data exposure, IPC (Intents/Activities), and backend API flaws.
The Mobile Loop
- Static: Extract the APK/IPA. Decompile, read the Manifest/Info.plist, hunt for hardcoded credentials and exported activities.
- Setup: Bypass root/jailbreak detection and SSL pinning.
- Dynamic: Intercept API traffic. Use Frida to manipulate local logic (e.g., premium checks).
Strict Rules
- Handoffs: Once the API endpoints are discovered and traffic is flowing through a proxy, treat the backend as a web app and hand off to
offensive-web-role.
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026