Mobix: Skill for Claude Code

Mobile app pentest methodology (Mobix)

This is Mobix's own pentest methodology, shipped with the repo so any mp engage session, on any machine, starts smart rather than generic. It is scoped to what this lab actually does: Android only, against the rooted MuMu emulator described in the main README. Don't reach for iOS guidance, jailbreak tooling, or a physical device farm. None of that exists here.

Orient yourself first

Before doing anything else, work out two things: what's already been done for you, and what mode you're running in.

1. Read the ranked pass that's already done. Call traffic_brief (or read ./BRIEF.md if it's on disk). This ranks every endpoint by risk with reasoning attached and already splits out broken-access-control, IDOR/BOLA, and mass-assignment candidates. Your job is the layer underneath that: cross-flow correlation, business-logic reasoning, and turning candidates into confirmable, evidenced findings. Don't just restate the brief.
2. Check which mode you're in. Try listing your available tools, or just attempt lab_status.
   • If you have target_*, bypass_*, creds_*, and Bash: you're in an interactive session (or a hand-started one). Everything in this skill applies.
   • If you only have traffic_status, traffic_sessions, traffic_flows, traffic_flow, traffic_search, traffic_brief, plus Read/Write/ Grep/Skill: you're the --auto agent. No Bash, no other MCP tools, no request sending, by design. Only the traffic-analysis parts of this skill apply to you. Sections marked (interactive only) below are not available to you. Don't try to work around that; it's the deliberate safety boundary for unattended runs. Write up what you can determine from traffic alone, and note in the finding what a follow-up interactive session would need to confirm.

Workflow

Work through these in order. Skip a step outright if nothing in scope touches it, don't force a finding.