Agent skill

Mobile Reverse

by sickn33 in sickn33/agentic-awesome-skills

Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP…

MITAuto-check passedSecurity

Install Mobile Reverse

skills CLI
$ npx skills add sickn33/agentic-awesome-skills --skill mobile-reverse -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install sickn33/agentic-awesome-skills mobile-reverse --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/sickn33/agentic-awesome-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/mobile-reverse .claude/skills/mobile-reverse && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
mobile-reverse
GitHub stars
47k
Used in
1 other repo
Token cost
~1.5k tokens
SKILL.md length
286 words
Files
4 (incl. references)
Skills in repo
1,394
Repo updated
First seen
Licence
MIT

At a glance

Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP…

  • Works in 4 steps: 信息收集 → 静态分析 → 动态分析 → …
  • Tasks that involve Reverse engineering and malware
  • SKILL.md covers When to Use, 适用场景, 四阶段工作流 and 常见绕过速查, plus 5 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Mobile Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `references/anti-detection-bypass.md`, `references/frida-objection-deep.md` and `references/ios-reverse-guide.md`).

It sits in Security, covering Reverse engineering and malware, Mobile application security and Web application vulnerabilities. It works with iOS, Frida and Android. The repository describes itself as: AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,400+ agentic skills. Includes… The licence is MIT.

When your agent uses it

  • Tasks that involve Reverse engineering and malware
  • Tasks that involve Mobile application security
  • Tasks that involve Web application vulnerabilities

Example prompts

  • “/mobile-reverse”

Requirements

  • Python 3

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. 信息收集
  2. 静态分析
  3. 动态分析
  4. 网络分析

What it can do on your machine

Read from SKILL.md and the folder at commit 1e53ce2. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash and javascript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Mobile Reverse loads about 1.5k tokens when it runs, and up to ~5.8k if it reads all its reference files. Until then it costs about 55 tokens; SKILL.md has 286 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~55
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~5.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from sickn33/agentic-awesome-skills at commit 1e53ce2, republished under its MIT licence (© sickn33). 286 words, ~1,498 tokens.

Download SKILL.mdSave it as .claude/skills/mobile-reverse/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
mobile-reverse
description
Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.
risk
offensive
source
https://github.com/zhaoxuya520/reverse-skill
source_repo
zhaoxuya520/reverse-skill
source_type
community
date_added
2026-08-25
license
MIT
license_source
https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

Mobile Reverse Engineering

When to Use

  • Assessing a mobile app's security posture within an approved scope.
  • Instrumenting runtime behavior or bypassing transport protections in tests.

适用场景

  • Android APK 逆向与安全测试
  • iOS IPA 逆向与安全测试
  • 移动应用运行时动态插桩
  • SSL Pinning / Root 检测 / 越狱检测绕过
  • 移动端加密算法提取(AES/RSA/HMAC 密钥)
  • 移动应用渗透测试(OWASP MASTG)
  • 非 Root/越狱环境下的应用测试

四阶段工作流

Phase 1: 信息收集
text
Android:
□ APK 获取(Google Play / APKMirror / adb pull)
□ Manifest 分析: 权限、导出组件、Intent Filter、backup 标志
□ androguard: androguard analyze APK → 组件/权限/签名
□ APKLeaks: 硬编码 API Key / Token / Secret 扫描
□ 加固检测: 是否加壳(360/腾讯/梆梆/爱加密)

iOS:
□ IPA 获取(App Store / ipatool / Apple Configurator)
□ 解密 App Store 二进制: frida-ios-dump / Clutch
□ Info.plist 分析: ATS 配置、URL Scheme、Queries Schemes
□ class-dump: 导出 ObjC 类结构
□ 加固检测: 是否使用 Swift/ObjC 混淆
Phase 2: 静态分析
text
跨平台:
□ JADX-GUI: APK → Java 源码(Android)
□ Ghidra / Hopper: .so / Mach-O 反编译
□ radare2 / Cutter: CLI 快速侦察

Android 专项:
□ apktool d app.apk → smali 代码 + 资源
□ dex2jar: DEX → JAR → JD-GUI
□ smali/baksmali: Dalvik 字节码修改

iOS 专项:
□ class-dump: 导出 ObjC 头文件
□ Swift 符号恢复: swift-demangle
□ dsymutil: 调试符号提取
□ otool -L: 查看动态库依赖
□ jtool2: Mach-O 分析
Phase 3: 动态分析
text
Frida — 通用动态插桩:
□ frida-ps -U: 列出设备进程
□ frida-trace -U -i "open*" com.app: 追踪函数调用
□ 自定义 Hook 脚本: 修改参数/返回值、调用私有方法

Objection — Frida 增强层(无需写脚本):
□ objection -g "com.app" explore
□ android root disable / ios jailbreak disable
□ android sslpinning disable / ios sslpinning disable
□ android keystore list / ios keychain dump
□ env / ls / sqlite connect

Frida Gadget(免 Root/越狱):
□ 注入 frida-gadget.so / FridaGadget.dylib 到 APK/IPA
□ 重新签名 → 安装 → 无需设备权限即可 Hook
□ objection patchapk --source app.apk(全自动)
Phase 4: 网络分析
text
□ Burp Suite: 拦截 HTTP/HTTPS,修改请求/响应
□ mitmproxy: 脚本化代理(Python API)
□ Wireshark: PCAP 抓包分析
□ 证书安装: Android 用户证书 → 系统证书(Magisk + MoveCert)
□ SSL Pinning 绕过: Frida/Objection/Xposed/SSL Kill Switch 2
□ WebSocket / gRPC 流量分析

常见绕过速查

SSL Pinning
bash
# Objection(最简)
objection -g "com.app" explore
android sslpinning disable

# Frida 通用脚本
frida -U -l ssl_pinning_bypass.js -f com.app

# Xposed(Android)
TrustMeAlready 模块 → 全局禁用证书校验
Root / 越狱检测
bash
# Objection
android root disable
ios jailbreak disable

# Frida 自定义(多层检测)
Java.perform(function() {
    var RootBeer = Java.use("com.scottyab.rootbeer.RootBeer");
    RootBeer.isRooted.implementation = function() { return false; };
    // 额外绕过: Magisk su 检测、frida-server 检测、/proc/self/maps 检测
});
反调试
bash
# Android
frida -U -l anti_debug_bypass.js -f com.app
# 绕过: ptrace(TracerPid)、/proc/self/status、isDebuggerConnected()

# iOS
# 绕过: PT_DENY_ATTACH、sysctl CTL_KERN/KERN_PROC/KERN_PROC_PID
frida -U -l ios_anti_debug.js -f com.app

移动端加密提取

javascript
// Android — Hook Cipher.getInstance 获取密钥+算法
Java.perform(function() {
    var Cipher = Java.use("javax.crypto.Cipher");
    Cipher.getInstance.overload('java.lang.String').implementation = function(algo) {
        console.log("[Cipher] Algorithm: " + algo);
        return this.getInstance(algo);
    };
    Cipher.init.overload('int', 'java.security.Key').implementation = function(mode, key) {
        console.log("[Cipher] Key: " + bytesToHex(key.getEncoded()));
        return this.init(mode, key);
    };
});

// iOS — Hook CCCrypt
Interceptor.attach(Module.findExportByName("libcommonCrypto.dylib", "CCCrypt"), {
    onEnter: function(args) {
        console.log("CCCrypt op: " + args[0] + " alg: " + args[1]);
        console.log("Key: " + hexdump(args[3], { length: args[4].toInt32() }));
    }
});

工具链

工具平台用途
JADX-GUIAJava 反编译
apktoolAAPK 解包/重建
GhidraA+I多架构反编译
HopperIiOS 专用反汇编
FridaA+I动态插桩
ObjectionA+IFrida REPL 增强
MobSFA+I自动化 SAST+DAST
class-dumpIObjC 类导出
frida-ios-dumpIIPA 解密
jtool2IMach-O 分析
Burp SuiteA+IHTTP 拦截
mitmproxyA+I脚本化代理

A=Android, I=iOS

参考

  • references/frida-objection-deep.md — Frida + Objection 深度用法
  • references/ios-reverse-guide.md — iOS 逆向专项
  • references/anti-detection-bypass.md — Root/越狱/反调试/SSL Pinning 绕过

任务完成自检(声称完成前 MUST 通过)

  • 我是否执行了工作流中的每一步(而不是只阅读)?
  • 我是否基于 tool-index 使用了真实工具路径?
  • 我是否产出了可复现证据(命令/脚本/截图/报告)?
  • 我是否完成并回写了 RULES 要求的 Checklist 项?

Limitations

  • iOS instrumentation requires a jailbroken device or patched build.
  • Bypass techniques break with app-shield vendor updates.

Adapted from zhaoxuya520/reverse-skill (MIT).

© sickn33, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (references) in skills/mobile-reverse of sickn33/agentic-awesome-skills.

  • SKILL.md
  • references/anti-detection-bypass.md
  • references/frida-objection-deep.md
  • references/ios-reverse-guide.md

Open the folder on GitHubat commit 1e53ce2

Used in 1 other repository

We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in sickn33/agentic-awesome-skills, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Mobile Reverse next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Mobile Reverse compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Mobile Reverse this skillsickn33/agentic-awesome-skills47k1 repos~1.5kAutomated safety check: PassMIT
Performing iOS App Security Assessmentmukul975/Anthropic-Cybersecurity-Skills34k—~3kAutomated safety check: PassApache-2.0
Mobile Securitytransilienceai/communitytools559—~2.5kAutomated safety check: PassMIT
Frida Mobile Securityindex-login/MobileRE-Skill111—~3kAutomated safety check: PassMIT
Mira Risk Collectvw2x/Mira105—~793Automated safety check: PassGPL-3.0
R0crawl Skillsmanyuegong33/r0crawl_skills305—~1.2kAutomated safety check: PassNone

Similar skills

  • Performing iOS App Security Assessment

    mukul975/Anthropic-Cybersecurity-Skills

    Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    SecurityAuto-check passed
  • Mobile Security

    transilienceai/communitytools

    Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC…

    559 GitHub stars~2.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed
  • Frida Mobile Security

    index-login/MobileRE-Skill

    用于 Android/iOS 移动应用安全逆向分析:Frida 动态插桩、绕过反调试/反注入/加固壳、脱壳、加密与 native SO 层 hook、运行时行为分析、jadx-mcp 静态攻击面分析、离线 SO 静态分析(ELF 侦察/字符串/交叉引用/反汇编/JNI 判型)。用户提到"绕过检测/闪退/脱壳/加密/抓包/行为摸底/内存扫描/分析 so/ELF…

    111 GitHub stars~3k tokensUpdated 7 days ago
    SecurityAuto-check passed
  • Run Mira environment risk collection. An agent skill from vw2x/Mira.

    105 GitHub stars~793 tokensUpdated 2 days ago
    SecurityAuto-check passed
  • R0crawl Skills

    manyuegong33/r0crawl_skills

    面向新手的全谱系逆向工程路由器,覆盖 Web/JavaScript、Android/iOS、Frida、脱壳、反分析、原生二进制、协议、固件、恶意软件、游戏、云 API、CTF、可复现一致性测试。用于逆向、起步、脱壳、反编译、hook、Frida、绕过检测、APK/SO/DEX/JS/PCAP/WASM/PE/ELF/Mach-O 分析、签名还原,或从样本到验证结果的完整调查。

    305 GitHub stars~1.2k tokensUpdated 17 days ago
    SecurityAuto-check passed
  • Conducting Mobile App Penetration Test

    mukul975/Anthropic-Cybersecurity-Skills

    Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network…

    34k GitHub stars~3.2k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from sickn33/agentic-awesome-skills

All 1,394 skills in this repo
  • Liuguang Banlan UI

    sickn33/agentic-awesome-skills

    Implements an interface in one of two named color modes, iridescent white or colorful black, from a parameterized starter that reports measured color intensity.

    47k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed
  • User Thoughts Memory

    sickn33/agentic-awesome-skills

    Saves a user's project decisions, rules and preferences into a project-local mdbase so later sessions and other agents can recover the intent.

    47k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed
  • Using LWC Memory and Graphs

    sickn33/agentic-awesome-skills

    Keeps project decisions, research and verified results available across coding-agent sessions through LWC memory, a document Wiki graph and a CodeGraph code index.

    47k GitHub starsUsed in 1 repo~2k tokens
    Auto-check passed
  • Find Complementary Founders

    sickn33/agentic-awesome-skills

    Guides an agent through assessing its own owner for cofounder fit, publishing an approved profile, and ranking complementary profiles other agents published for their owners.

    47k GitHub starsUsed in 1 repo~4.8k tokens
    Auto-check passed
  • Whatsapp Cloud API

    sickn33/agentic-awesome-skills

    Integracao com WhatsApp Business Cloud API (Meta). An agent skill from sickn33/agentic-awesome-skills.

    47k GitHub starsUsed in 2 repos~4.5k tokens
    Auto-check passed
  • Cline Pilot

    sickn33/agentic-awesome-skills

    Acts as a proxy for the Cline CLI, dispatching coding tasks one at a time, monitoring runs by hard evidence, relaying decisions to you and learning per-project preferences.

    47k GitHub starsUsed in 1 repo~4.6k tokens
    Auto-check passed

Works with

Categories

Questions about Mobile Reverse

What does Mobile Reverse do?

Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP…. Mobile Reverse is an agent skill from sickn33/agentic-awesome-skills. Authorized Android/iOS application reverse engineering and security testing: APK/IPA analysis, runtime instrumentation (Frida/Objection), SSL-pinning and jailbreak/root-detection bypass, per OWASP MASTG.

When should I use Mobile Reverse?

Mobile Reverse fits situations like: tasks that involve Reverse engineering and malware; tasks that involve Mobile application security; tasks that involve Web application vulnerabilities.

How do I install Mobile Reverse in Claude Code?

Run `npx skills add sickn33/agentic-awesome-skills --skill mobile-reverse -a claude-code`. Or copy the skill folder (skills/mobile-reverse in sickn33/agentic-awesome-skills) into .claude/skills/mobile-reverse in your project. Claude Code loads it when a task matches its description.

How do I install Mobile Reverse in Codex?

Run `npx skills add sickn33/agentic-awesome-skills --skill mobile-reverse -a codex`. Or copy the skill folder (skills/mobile-reverse in sickn33/agentic-awesome-skills) into .agents/skills/mobile-reverse in your project. Codex loads it when a task matches its description.

Can I use Mobile Reverse in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add sickn33/agentic-awesome-skills --skill mobile-reverse -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/mobile-reverse, .gemini/skills/mobile-reverse, .github/skills/mobile-reverse and .opencode/skills/mobile-reverse in your project.

What does Mobile Reverse need to run?

SKILL.md names no scripts, command-line tools or credentials: Mobile Reverse is instructions for the agent only. Our summary lists: Python 3.

Does Mobile Reverse access the network?

SKILL.md names 1 domain. As links in the text: github.com. This is read from the text; nothing was executed.

Is Mobile Reverse safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Mobile Reverse use?

Mobile Reverse is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Mobile Reverse use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.3k tokens, read only when the agent opens those files.

What are the alternatives to Mobile Reverse?

Skills that share tags, products or a category with Mobile Reverse: Performing iOS App Security Assessment (mukul975/Anthropic-Cybersecurity-Skills, 34k stars), Mobile Security (transilienceai/communitytools, 559 stars), Frida Mobile Security (index-login/MobileRE-Skill, 111 stars) and Mira Risk Collect (vw2x/Mira, 105 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Mobile Reverse?

sickn33 (a GitHub user) maintains it in sickn33/agentic-awesome-skills, which has 47,304 GitHub stars. The repository holds 1,394 skills in this directory. The repository was last updated on October 6, 2026.

Source: sickn33/agentic-awesome-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.