Agent skill

Bypassing Mobile Pinning

MITAuto-check passedSecurity

Install Bypassing Mobile Pinning

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .claude/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .claude/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .agents/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .agents/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .cursor/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .cursor/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/trilwu/secskills.git --path secskills-offense/skills/bypassing-mobile-pinning

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .gemini/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .gemini/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .github/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .github/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .github/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install trilwu/secskills bypassing-mobile-pinning --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/trilwu/secskills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/secskills-offense/skills/bypassing-mobile-pinning .opencode/skills/bypassing-mobile-pinning && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "bypassing-mobile-pinning" agent skill from https://github.com/trilwu/secskills/tree/main/secskills-offense/skills/bypassing-mobile-pinning into .opencode/skills/bypassing-mobile-pinning/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "bypassing-mobile-pinning", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: bypassing-mobile-pinning
GitHub stars: 157
Token cost: ~2.5k tokens
SKILL.md length: 1,020 words
Files: 1
Skills in repo: 50
Repo updated: Sep 4, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Works in 6 steps: The app never used your proxy. Some… → Certificate Transparency enforcement.… → Mutual TLS. The server demands a client… → …
Charles shows a TLS handshake error
SKILL.md covers When to Use, When NOT to Use, Diagnose First and Android: Hook by Stack, plus 5 more sections
Calls adb, rg and openssl

What it does

Bypassing Mobile Pinning is an agent skill from trilwu/secskills. Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection, Frida, SSL Kill Switch, and APK patching. Use when Burp, mitmproxy, or Charles shows a TLS handshake error, an empty proxy, or "network error" from a mobile app, or when a target is known to pin certificates.

Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Network security and Mobile application security. It works with Android, Frida and Flutter. The repository describes itself as: Transform Claude Code into your personal security engineer. The licence is MIT.

When your agent uses it

Charles shows a TLS handshake error
Network error from a mobile app
A target is known to pin certificates

Example prompts

“network error”
“/bypassing-mobile-pinning”

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

The app never used your proxy. Some stacks ignore system proxy settings
Certificate Transparency enforcement. Some SDKs require SCTs; your CA
Mutual TLS. The server demands a client certificate. Extract the .p12
Root/jailbreak or Frida detection. The app detects instrumentation and
The traffic is not HTTP. WebSockets, gRPC, MQTT, or a custom protocol
Pinning applied only to specific hosts. Analytics flows fine while the

What it can do on your machine

Read from SKILL.md and the folder at commit ca53957. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- adb
- rg
- openssl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Bypassing Mobile Pinning loads about 2.5k tokens when it runs. Until then it costs about 107 tokens; SKILL.md has 1,020 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~107
When it runs · the whole SKILL.md, loaded when a task matches: ~2.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trilwu/secskills at commit ca53957, republished under its MIT licence (© trilwu). 1,020 words, ~2,544 tokens.

Download SKILL.mdSave it as .claude/skills/bypassing-mobile-pinning/SKILL.md (or your agent's skills folder).

name: bypassing-mobile-pinning
description: Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection, Frida, SSL Kill Switch, and APK patching. Use when Burp, mitmproxy, or Charles shows a TLS handshake error, an empty proxy, or "network error" from a mobile app, or when a target is known to pin certificates.
verified: 2026-07-27

Bypassing Mobile Pinning

Most time lost here is spent bypassing pinning that was never there. An empty proxy has at least six causes, and the fix for each is different — one of them is not pinning at all but Android's default distrust of user CAs, and another is that the app has its own TLS stack and never saw your proxy. Diagnose before you reach for a bypass script.

Use only against apps you are authorized to test.

When to Use

Burp/mitmproxy/Charles shows a TLS handshake failure from a mobile app
The proxy shows nothing while the app clearly reaches the network
The app reports "network error", "connection insecure", or similar with the proxy configured
You know the target pins, and need the right hook for its stack

When NOT to Use

Flutter targets — use reversing-flutter-apps; Flutter's failure looks identical but the cause and fix are specific to its engine
The wider mobile assessment — use testing-mobile-applications
The backend once traffic is visible — use testing-apis
Reversing a native .so in depth — use analyzing-binaries

Diagnose First

Run this before installing anything. The symptom tells you the cause.

Symptom	Likely cause	Fix
Proxy sees the CONNECT, then TLS alert `unknown_ca` / `bad_certificate`	Your CA is not trusted	Install as system CA, or patch Network Security Config
Proxy sees the CONNECT, then alert only for some domains	Real pinning, scoped to those hosts	Hook the pinning check
Proxy sees nothing at all, app works	App ignores the system proxy	Force traffic at the network layer (Flutter, gRPC, some SDKs)
Proxy sees the handshake, server rejects the client	Mutual TLS — the app presents a client certificate	Extract the client cert; this is not pinning
Works on emulator, fails on device (or vice versa)	Root/emulator detection, not TLS	Different problem — see the detection section
Fails only after login	Pinning applied to the API host only	Hook, then re-check

bash

# What does the app actually declare?
apktool d target.apk -o out
cat out/res/xml/network_security_config.xml 2>/dev/null
rg -n 'networkSecurityConfig|usesCleartextTraffic' out/AndroidManifest.xml

# Which TLS stack is in play?
rg -l 'okhttp3|CertificatePinner|TrustKit|AFNetworking|Alamofire' out/ 2>/dev/null | head
unzip -l target.apk | rg 'libssl|libcrypto|libconscrypt|libflutter|libil2cpp|libmonodroid'

Check Network Security Config before assuming pinning. Since Android 7, apps do not trust user-installed CAs by default. An app with no pinning code at all will still fail interception. Two fixes:

bash

# A. Install your CA as a SYSTEM certificate (no app modification — preferred)
#    Emulator:
emulator -avd <name> -writable-system
adb root && adb remount
openssl x509 -inform PEM -subject_hash_old -in burp.pem | head -1   # → e.g. 9a5ba580
cp burp.pem 9a5ba580.0 && adb push 9a5ba580.0 /system/etc/security/cacerts/
adb shell chmod 644 /system/etc/security/cacerts/9a5ba580.0
#    Rooted device: use a Magisk module so the change survives reboot

# B. Patch the config and repack (when you cannot get a system CA)
#    Add to network_security_config.xml:
#      <base-config><trust-anchors>
#        <certificates src="system"/><certificates src="user"/>
#      </trust-anchors></base-config>
apktool b out -o patched.apk && apksigner sign --ks debug.keystore patched.apk

Option A is better: it modifies nothing in the app, so integrity checks, signature checks, and Play Integrity are unaffected. Reach for B only when you cannot get a system CA onto the device.

Android: Hook by Stack

Identify the stack, then hook it. A generic script that misses will look like "the bypass failed" when it simply targeted the wrong layer.

bash

# Start here — covers the common Java-layer stacks in one shot
objection -g com.target.app explore
# then: android sslpinning disable

# Or a maintained universal script
frida -U -f com.target.app -l android-ssl-bypass.js --no-pause

Stack	Marker	Hook point
OkHttp 3/4	`okhttp3.CertificatePinner`	`CertificatePinner.check()` — return normally
HttpURLConnection	`javax.net.ssl.*`	Custom `X509TrustManager.checkServerTrusted()`
Conscrypt	`libconscrypt_jni.so`	`Platform.checkServerTrusted`, or the native layer
Apache HttpClient	`org.apache.http`	`SSLSocketFactory` verifier
WebView	`onReceivedSslError`	Force `handler.proceed()`
Native / BoringSSL	`libssl.so`, custom `.so`	`SSL_CTX_set_custom_verify`, `ssl_verify_peer_cert`
Xamarin	`libmonodroid.so`, `libxamarin*`	Mono-level `ServicePointManager` / `HttpClientHandler`
Unity	`libil2cpp.so`	`UnityWebRequest` cert handler, or BestHTTP's verifier
gRPC	`libgrpc.so`	Channel credentials; often also ignores the proxy

Native pinning is where the universal scripts stop working. When objection reports success but traffic still fails, the check is in a .so. BoringSSL's verification entry points are not exported, so scripts locate them by pattern scanning — and the pattern is version-specific. Confirm what you are dealing with:

bash

# Is a native TLS stack even present?
unzip -j target.apk 'lib/arm64-v8a/*' -d libs && rg -l 'SSL_|BoringSSL|s2n' libs/
# Trace the native calls to see which library terminates TLS
frida-trace -U -f com.target.app -i 'SSL_*' -i '*verify*'

For Unity, Xamarin, and Flutter builds, recover symbols first — reversing-unity-il2cpp, reversing-flutter-apps — then hook the named function rather than pattern-scanning blind.

iOS

bash

# Frida-based, covers NSURLSession and the common libraries
objection -g com.target.app explore
# then: ios sslpinning disable

# Jailbroken device, no Frida
# SSL Kill Switch 3 — system-wide, survives app updates

Library	Hook point
NSURLSession (default)	`URLSession:didReceiveChallenge:` → `.useCredential` with the server trust
TrustKit	`TSKPinningValidator` result
AFNetworking	`AFSecurityPolicy.evaluateServerTrust:`
Alamofire	`ServerTrustManager` / `ServerTrustEvaluating`
Native/BoringSSL	Same as Android — hook the verify callback

Non-jailbroken devices: repackage the IPA with the Frida gadget (objection patchipa), re-sign, and sideload. Expect this to trip integrity or attestation checks in hardened apps.

Show full SKILL.md (452 more words)Show less

When It Still Fails

Work through these in order rather than trying more bypass scripts.

The app never used your proxy. Some stacks ignore system proxy settings entirely. Force traffic: transparent redirect with iptables, or a VPN/tun-based proxy.
bash
```
adb shell su -c 'iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to <proxy>:8080'
```
Certificate Transparency enforcement. Some SDKs require SCTs; your CA has none. Look for CT libraries and hook the CT verifier specifically.
Mutual TLS. The server demands a client certificate. Extract the .p12 or keystore from the app bundle, recover its password (often in code or strings), and load it into your proxy's client-certificate settings. This is a separate mechanism from pinning and no pinning bypass will touch it.
Root/jailbreak or Frida detection. The app detects instrumentation and fails closed, which looks like a TLS problem. Check for a frida string scan, port 27042 probing, /proc/self/maps inspection, or Play Integrity. Bypass the detection first, then retry the pinning bypass.
The traffic is not HTTP. WebSockets, gRPC, MQTT, or a custom protocol over TLS. Your HTTP proxy will not show it — capture at the socket layer or with a protocol-aware proxy.
Pinning applied only to specific hosts. Analytics flows fine while the API fails. Confirm by comparing which hosts appear in the proxy.

Verify You Actually Won

A bypass is confirmed when you can see and modify a request end to end — not when the app merely stops erroring.

1. Proxy shows the API host, not just analytics and CDN traffic
2. Request and response bodies are readable
3. A modified request produces a different server response
4. Authenticated flows still work through the proxy

If only step 1 passes, you may be seeing a fallback path while the real API traffic goes elsewhere.

Rationalizations to Reject

"The bypass failed, the app must use strong pinning." Six causes, one of which is pinning. Diagnose from the symptom table.
"I installed the CA, so TLS should work." As a user certificate, on Android 7+, for an app that does not opt in — it will not.
"objection said pinning disabled." It disabled the Java-layer checks it knows. Native pinning is untouched.
"No traffic in the proxy means the app is offline." It means the app is not using your proxy.
"I'll just patch the APK." Repacking breaks signatures and trips integrity checks. Prefer a system CA and runtime hooks; patch as a last resort.
"Pinning bypassed, assessment done." Bypassing pinning is setup, not a finding. Pinning is a defense-in-depth control, and its absence is a low severity note — the findings are in the API behind it.

References

testing-mobile-applications — the wider assessment this unblocks
reversing-flutter-apps — Flutter's separate TLS stack and proxy behaviour
reversing-unity-il2cpp, reversing-react-native-apps — symbol recovery before hooking framework-specific stacks
testing-apis — where the actual findings are, once you can see the traffic
objection, Frida, SSL Kill Switch 3, apktool, apksigner, Magisk

Files

Just SKILL.md in secskills-offense/skills/bypassing-mobile-pinning of trilwu/secskills.

Open the folder on GitHubat commit ca53957

Compare with similar skills

Bypassing Mobile Pinning next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Bypassing Mobile Pinning compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Bypassing Mobile Pinning this skilltrilwu/secskills	157	—	~2.5k	Automated safety check: Pass	MIT	1 mo ago
Mobile Securitytransilienceai/communitytools	563	—	~2.5k	Automated safety check: Pass	MIT	2 mo ago
Mobile App Security Testinglangbyyi/CyberStrikeAI-SRC	129	—	~12k	Automated safety check: Pass	Apache-2.0	4 days ago
Frida Mobile Securityindex-login/MobileRE-Skill	158	—	~3k	Automated safety check: Pass	MIT	yesterday
Mira Risk Collectvw2x/Mira	105	—	~793	Automated safety check: Pass	GPL-3.0	6 days ago
Rev Dex Dumperindex-login/MobileRE-Skill	158	—	~1.9k	Automated safety check: Pass	MIT	yesterday

Similar skills

Mobile Security
transilienceai/communitytools
Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC…
563 GitHub stars~2.5k tokensUpdated 2 mo ago
SecurityAuto-check passed
Mobile App Security Testing
langbyyi/CyberStrikeAI-SRC
移动应用安全深度测试专业技能（v3.0）：移动端深层攻击链（App→API→后端→云）、Android/iOS深度逆向与动态调试、Frida全面对抗与加固脱壳、iOS越狱检测绕过/ObjC Runtime/LLDB调试/证书固定绕过、跨平台框架漏洞（Flutter/React…
129 GitHub stars~12k tokensUpdated 4 days ago
SecurityAuto-check passed
Frida Mobile Security
index-login/MobileRE-Skill
用于 Android/iOS 移动应用安全逆向分析：Frida 动态插桩、绕过反调试/反注入/加固壳、脱壳、加密与 native SO 层 hook、运行时行为分析、jadx-mcp 静态攻击面分析、离线 SO 静态分析（ELF 侦察/字符串/交叉引用/反汇编/JNI 判型）。用户提到"绕过检测/闪退/脱壳/加密/抓包/行为摸底/内存扫描/分析 so/ELF…
158 GitHub stars~3k tokensUpdated yesterday
SecurityAuto-check passed
Mira Risk Collect
vw2x/Mira
Run Mira environment risk collection. An agent skill from vw2x/Mira.
105 GitHub stars~793 tokensUpdated 6 days ago
SecurityAuto-check passed
Rev Dex Dumper
index-login/MobileRE-Skill
Root memory dump of DEX from a running Android app: no injection, no ptrace (survives ptrace-blocking anti-debug; invisible to Frida checks), twin tools cross-check each other.
158 GitHub stars~1.9k tokensUpdated yesterday
SecurityAuto-check passed
R0crawl Skills
manyuegong33/r0crawl_skills
面向新手的全谱系逆向工程路由器，覆盖 Web/JavaScript、Android/iOS、Frida、脱壳、反分析、原生二进制、协议、固件、恶意软件、游戏、云 API、CTF、可复现一致性测试。用于逆向、起步、脱壳、反编译、hook、Frida、绕过检测、APK/SO/DEX/JS/PCAP/WASM/PE/ELF/Mach-O 分析、签名还原，或从样本到验证结果的完整调查。
312 GitHub stars~1.2k tokensUpdated 21 days ago
SecurityAuto-check passed

Questions about Bypassing Mobile Pinning

What does Bypassing Mobile Pinning do?

Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection…. Bypassing Mobile Pinning is an agent skill from trilwu/secskills. Diagnose and defeat TLS interception failures in mobile apps — certificate pinning, Android Network Security Config, user-CA distrust, native BoringSSL pinning, and mutual TLS — using objection, Frida, SSL Kill Switch, and APK patching.

When should I use Bypassing Mobile Pinning?

Bypassing Mobile Pinning fits situations like: charles shows a TLS handshake error; network error from a mobile app; A target is known to pin certificates.

How do I install Bypassing Mobile Pinning in Claude Code?

Run `npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a claude-code`. Or copy the skill folder (secskills-offense/skills/bypassing-mobile-pinning in trilwu/secskills) into .claude/skills/bypassing-mobile-pinning in your project. Claude Code loads it when a task matches its description.

How do I install Bypassing Mobile Pinning in Codex?

Run `npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a codex`. Or copy the skill folder (secskills-offense/skills/bypassing-mobile-pinning in trilwu/secskills) into .agents/skills/bypassing-mobile-pinning in your project. Codex loads it when a task matches its description.

Can I use Bypassing Mobile Pinning in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trilwu/secskills --skill bypassing-mobile-pinning -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/bypassing-mobile-pinning, .gemini/skills/bypassing-mobile-pinning, .github/skills/bypassing-mobile-pinning and .opencode/skills/bypassing-mobile-pinning in your project.

What does Bypassing Mobile Pinning need to run?

Going by SKILL.md and its folder, Bypassing Mobile Pinning needs the command-line tools its instructions call (adb, rg and openssl).

Does Bypassing Mobile Pinning access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Bypassing Mobile Pinning safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Bypassing Mobile Pinning use?

Bypassing Mobile Pinning is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Bypassing Mobile Pinning use?

About 2.5k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Bypassing Mobile Pinning?

Skills that share tags, products or a category with Bypassing Mobile Pinning: Mobile Security (transilienceai/communitytools, 563 stars), Mobile App Security Testing (langbyyi/CyberStrikeAI-SRC, 129 stars), Frida Mobile Security (index-login/MobileRE-Skill, 158 stars) and Mira Risk Collect (vw2x/Mira, 105 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Bypassing Mobile Pinning?

trilwu (a GitHub user) maintains it in trilwu/secskills, which has 157 GitHub stars. The repository holds 50 skills in this directory. The repository was last updated on September 4, 2026.

Source: trilwu/secskills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Bypassing Mobile Pinning

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Bypassing Mobile Pinning

When to Use

When NOT to Use

Diagnose First

Android: Hook by Stack

iOS

When It Still Fails

Verify You Actually Won

Rationalizations to Reject

References

Files

Compare with similar skills

Similar skills

More from trilwu/secskills

Related

Questions about Bypassing Mobile Pinning