New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Performing Android App Static Analysis With Mobsf

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and…

Apache-2.0Auto-check passedSecurity

Install Performing Android App Static Analysis With Mobsf

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills performing-android-app-static-analysis-with-mobsf --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/performing-android-app-static-analysis-with-mobsf .claude/skills/performing-android-app-static-analysis-with-mobsf && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
performing-android-app-static-analysis-with-mobsf
GitHub stars
34k
Token cost
~1.8k tokens
SKILL.md length
615 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and…

  • Works in 6 steps: Deploy MobSF and Obtain API Key → Upload APK for Static Analysis → Trigger and Retrieve Static Scan Results → …
  • Assessing Android APK/AAB files for security vulnerabilities before deployment
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 2 more sections
  • Runs Python scripts from its folder; calls curl and docker; needs API_KEY and MOBSF_API_KEY

What it does

Performing Android App Static Analysis With Mobsf is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or…

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Static analysis and SAST, Android development and Mobile application security. It works with Android and Docker. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Assessing Android APK/AAB files for security vulnerabilities before deployment
  • During penetration testing
  • As part of CI/CD security gates

Example prompts

  • “Use the performing-android-app-static-analysis-with-mobsf skill to perform automated static analysis of Android applications using Mobile Security…”
  • “/performing-android-app-static-analysis-with-mobsf”

Requirements

  • Python 3
  • Docker
  • A credential in API_KEY
  • A credential in MOBSF_API_KEY

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Deploy MobSF and Obtain API Key
  2. Upload APK for Static Analysis
  3. Trigger and Retrieve Static Scan Results
  4. Analyze Critical Findings
  5. Generate and Export Reports
  6. Integrate into CI/CD Pipeline

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • curl
    • docker

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use curl and docker, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • API_KEY
    • MOBSF_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Performing Android App Static Analysis With Mobsf loads about 1.8k tokens when it runs, and up to ~4.9k if it reads all its reference files. Until then it costs about 149 tokens; SKILL.md has 615 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~149
When it runs · the whole SKILL.md, loaded when a task matches
~1.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 615 words, ~1,841 tokens.

Download SKILL.mdSave it as .claude/skills/performing-android-app-static-analysis-with-mobsf/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
performing-android-app-static-analysis-with-mobsf
description
Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
domain
cybersecurity
subdomain
mobile-security
author
mahipal
tags
mobile-security, android, mobsf, static-analysis, owasp-mobile, penetration-testing
version
1.0.0
license
Apache-2.0
nist_csf
PR.PS-01, PR.AA-05, ID.RA-01, DE.CM-09
mitre_attack
T1059, T1056, T1036, T1078

Performing Android App Static Analysis with MobSF

When to Use

Use this skill when:

  • Conducting security assessment of Android APK or AAB files before production release
  • Integrating automated mobile security scanning into CI/CD pipelines
  • Performing initial triage of Android applications during penetration testing engagements
  • Reviewing third-party Android applications for supply chain security risks

Do not use this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws.

Prerequisites

  • MobSF v4.x installed via Docker (docker pull opensecurity/mobile-security-framework-mobsf) or local setup
  • Target Android APK, AAB, or source code ZIP
  • Python 3.10+ for MobSF REST API integration
  • JADX decompiler (bundled with MobSF) for Java/Kotlin source recovery
  • Network access to MobSF web interface (default: http://localhost:8000)

Workflow

Step 1: Deploy MobSF and Obtain API Key

Launch MobSF using Docker for isolated, reproducible scanning:

bash
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest

Retrieve the REST API key from the MobSF web interface at http://localhost:8000/api_docs or from the startup console output. The API key enables programmatic scanning.

Step 2: Upload APK for Static Analysis

Upload the target APK using the MobSF REST API:

bash
curl -F "file=@target_app.apk" http://localhost:8000/api/v1/upload \
  -H "Authorization: <API_KEY>"

Response includes the hash identifier used for subsequent API calls. MobSF automatically decompiles the APK using JADX, extracts the AndroidManifest.xml, and indexes all resources.

Step 3: Trigger and Retrieve Static Scan Results

Initiate the static scan and retrieve results:

bash
# Trigger scan
curl -X POST http://localhost:8000/api/v1/scan \
  -H "Authorization: <API_KEY>" \
  -d "scan_type=apk&file_name=target_app.apk&hash=<FILE_HASH>"

# Retrieve JSON report
curl -X POST http://localhost:8000/api/v1/report_json \
  -H "Authorization: <API_KEY>" \
  -d "hash=<FILE_HASH>"
Step 4: Analyze Critical Findings

MobSF static analysis covers these categories mapped to OWASP Mobile Top 10 2024:

Manifest Analysis (M8 - Security Misconfiguration):

  • Exported activities, services, receivers, and content providers without permission guards
  • android:debuggable="true" left enabled
  • android:allowBackup="true" enabling data extraction via ADB
  • Missing android:networkSecurityConfig for certificate pinning

Code Analysis (M1 - Improper Credential Usage):

  • Hardcoded API keys, passwords, and tokens in Java/Kotlin source
  • Insecure SharedPreferences usage for storing sensitive data
  • Weak or broken cryptographic implementations (ECB mode, static IV, hardcoded keys)

Network Security (M5 - Insecure Communication):

  • Missing certificate pinning configuration
  • Custom TrustManagers that accept all certificates
  • Cleartext HTTP traffic allowed without exception domains

Binary Analysis (M7 - Insufficient Binary Protections):

  • Missing ProGuard/R8 obfuscation
  • Native library vulnerabilities (stack canaries, NX bit, PIE)
  • Debugger detection absence
Step 5: Generate and Export Reports

Export findings in multiple formats for stakeholder communication:

bash
# PDF report
curl -X POST http://localhost:8000/api/v1/download_pdf \
  -H "Authorization: <API_KEY>" \
  -d "hash=<FILE_HASH>" -o report.pdf

# JSON for programmatic processing
curl -X POST http://localhost:8000/api/v1/report_json \
  -H "Authorization: <API_KEY>" \
  -d "hash=<FILE_HASH>" -o report.json
Step 6: Integrate into CI/CD Pipeline

Add MobSF scanning as a build gate:

yaml
# GitHub Actions example
- name: MobSF Static Analysis
  run: |
    UPLOAD=$(curl -s -F "file=@app/build/outputs/apk/release/app-release.apk" \
      http://mobsf:8000/api/v1/upload -H "Authorization: $MOBSF_API_KEY")
    HASH=$(echo $UPLOAD | jq -r '.hash')
    curl -s -X POST http://mobsf:8000/api/v1/scan \
      -H "Authorization: $MOBSF_API_KEY" \
      -d "scan_type=apk&file_name=app-release.apk&hash=$HASH"
    SCORE=$(curl -s -X POST http://mobsf:8000/api/v1/scorecard \
      -H "Authorization: $MOBSF_API_KEY" -d "hash=$HASH" | jq '.security_score')
    if [ "$SCORE" -lt 60 ]; then exit 1; fi
Show full SKILL.md (247 more words)Show less

Key Concepts

TermDefinition
Static AnalysisExamination of application code and resources without executing the program; catches structural and pattern-based vulnerabilities
APK DecompilationProcess of recovering Java/Kotlin source from compiled Dalvik bytecode using tools like JADX or apktool
AndroidManifest.xmlConfiguration file declaring app components, permissions, and security attributes; primary target for manifest analysis
Certificate PinningTechnique binding an app to specific server certificates to prevent man-in-the-middle attacks via rogue CAs
ProGuard/R8Code obfuscation and shrinking tools that make reverse engineering more difficult by renaming classes and removing unused code

Tools & Systems

  • MobSF: Automated mobile security analysis framework supporting static and dynamic analysis of Android/iOS apps
  • JADX: Dex-to-Java decompiler for recovering readable source code from Android APK files
  • apktool: Tool for reverse engineering Android APK files, decoding resources to near-original form
  • Android Lint: Google's static analysis tool for Android-specific code quality and security issues
  • Semgrep: Pattern-based static analysis engine with mobile-specific rule packs for custom vulnerability detection

Common Pitfalls

  • Ignoring false positives: MobSF flags patterns like password in variable names even when not storing actual credentials. Triage all HIGH findings manually before reporting.
  • Missing obfuscated code: Static analysis accuracy drops significantly against obfuscated apps. Supplement with dynamic analysis for apps using DexGuard or custom packers.
  • Outdated MobSF rules: Security rules evolve with Android API levels. Ensure MobSF is updated to match the target app's targetSdkVersion.
  • Skipping native code analysis: MobSF analyzes Java/Kotlin but has limited coverage of native C/C++ libraries. Use checksec and manual review for .so files.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/performing-android-app-static-analysis-with-mobsf of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Performing Android App Static Analysis With Mobsf next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Performing Android App Static Analysis With Mobsf compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Performing Android App Static Analysis With Mobsf this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.8kAutomated safety check: PassApache-2.0
Code Securitysemgrep/skills322—~1.2kAutomated safety check: PassCustom licence
Android APK Pentesterptn1411/skill220—~917Automated safety check: PassNone
Cyber NeoHainrixz/cyber-neo283—~5.9kAutomated safety check: WarnMIT
Agentic GitHub Actions Auditortrailofbits/skills7.4k6 repos~5.4kAutomated safety check: NotesCC-BY-SA-4.0
Svc Mobile Androids0ld13rr/pentestcode828—~2.9kAutomated safety check: PassMIT

Similar skills

  • Code Security

    semgrep/skills

    Official

    Security guidelines for writing secure code. An agent skill from semgrep/skills.

    322 GitHub stars~1.2k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Android APK Pentester

    ptn1411/skill

    Runs a full workflow for authorized Android app security testing: static APK analysis, rooted emulator setup, traffic interception and Frida hook generation.

    220 GitHub stars~917 tokensUpdated 17 days ago
    SecurityAuto-check passed

  • Cyber Neo

    Hainrixz/cyber-neo

    Comprehensive cybersecurity analysis for any local project. An agent skill from Hainrixz/cyber-neo.

    283 GitHub stars~5.9k tokensUpdated 2 mo ago
    SecurityAuto-check: warnings

  • Agentic GitHub Actions Auditor

    trailofbits/skills

    Official

    Statically audits GitHub Actions workflows that run AI coding agents, tracing attacker-controlled input to agent prompts and flagging unsafe sandbox, trigger and allowlist settings.

    7.4k GitHub starsUsed in 6 repos~5.4k tokens
    SecurityAuto-check: notes

  • Svc Mobile Android

    s0ld13rr/pentestcode

    Android APK static analysis — OWASP Mobile Top 10, Retrofit API audit, transport security, smali reading, component export, auth flow analysis.

    828 GitHub stars~2.9k tokensUpdated 6 days ago
    SecurityAuto-check passed

  • Hadolint Dockerfile Security Linting

    AgentSecOps/SecOpsAgentKit

    Lints Dockerfiles with Hadolint for security misconfigurations and best-practice violations, locally and in CI, with strict, balanced and permissive rule templates.

    220 GitHub starsUsed in 1 repo~4.4k tokens
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Performing Android App Static Analysis With Mobsf

What does Performing Android App Static Analysis With Mobsf do?

Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and…. Performing Android App Static Analysis With Mobsf is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application.

When should I use Performing Android App Static Analysis With Mobsf?

Performing Android App Static Analysis With Mobsf fits situations like: assessing Android APK/AAB files for security vulnerabilities before deployment; during penetration testing; as part of CI/CD security gates.

How do I install Performing Android App Static Analysis With Mobsf in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf -a claude-code`. Or copy the skill folder (skills/performing-android-app-static-analysis-with-mobsf in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/performing-android-app-static-analysis-with-mobsf in your project. Claude Code loads it when a task matches its description.

How do I install Performing Android App Static Analysis With Mobsf in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf -a codex`. Or copy the skill folder (skills/performing-android-app-static-analysis-with-mobsf in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/performing-android-app-static-analysis-with-mobsf in your project. Codex loads it when a task matches its description.

Can I use Performing Android App Static Analysis With Mobsf in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/performing-android-app-static-analysis-with-mobsf, .gemini/skills/performing-android-app-static-analysis-with-mobsf, .github/skills/performing-android-app-static-analysis-with-mobsf and .opencode/skills/performing-android-app-static-analysis-with-mobsf in your project.

What does Performing Android App Static Analysis With Mobsf need to run?

Going by SKILL.md and its folder, Performing Android App Static Analysis With Mobsf needs Python for the scripts in its folder, the command-line tools its instructions call (curl and docker) and credentials named API_KEY and MOBSF_API_KEY. Our summary lists: Python 3; Docker; A credential in API_KEY; A credential in MOBSF_API_KEY.

Does Performing Android App Static Analysis With Mobsf access the network?

SKILL.md contains no URLs. Its commands use curl and docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Performing Android App Static Analysis With Mobsf safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Performing Android App Static Analysis With Mobsf use?

Performing Android App Static Analysis With Mobsf is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Performing Android App Static Analysis With Mobsf use?

About 1.8k tokens (SKILL.md is roughly 7.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.1k tokens, read only when the agent opens those files.

What are the alternatives to Performing Android App Static Analysis With Mobsf?

Skills that share tags, products or a category with Performing Android App Static Analysis With Mobsf: Code Security (semgrep/skills, 322 stars), Android APK Pentester (ptn1411/skill, 220 stars), Cyber Neo (Hainrixz/cyber-neo, 283 stars) and Agentic GitHub Actions Auditor (trailofbits/skills, 7.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Performing Android App Static Analysis With Mobsf?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,993 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.