Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fb0sh/pentester/android-pentestnpx skills add fb0sh/pentester --skill android-pentestgit clone --depth 1 https://github.com/fb0sh/pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.00670 |
| Opus 5 | $0.00016 | $0.00335 |
| Sonnet 5 | $0.00006 | $0.00134 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
android-pentest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to android-pentest — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
安卓应用渗透测试 Skill
针对安卓应用的专项渗透测试，遵循 runtime-first 原则：先运行态驱动、先抓包，最后才逆向。
需要更深入的客户端逆向知识？ 使用 client-reverse Skill，包含完整的签名恢复、加密还原、Burp 重放工作流。
核心原则
不要先逆向 APK。默认操作顺序：
- 确认目标 App 已安装在连接设备上
- 准备好 Burp 或 Charles 抓包
- 用 scrcpy_vision 驱动真实业务流程
- 每个关键动作后检查抓包状态
- 包可见且可重放 → 直接做 Web/API 安全测试
- 只有抓不到包/包被加密时 → 升级到 jadx/frida/ida
1. 环境准备
- 通过 adb-mcp 连接设备/模拟器
- 通过 jadx 反编译目标 APK
- 通过 burp-mcp 配置代理抓包
2. 自动化探索
- 启动 APP，通过 adb-mcp 自动截图
- 通过 frida-mcp Hook 关键函数
- 通过 burp-mcp 捕获和分析数据流
- 自动点击 UI 元素，遍历功能点
- 模拟用户行为，识别敏感数据流
3. 深度分析
- 通过 jadx 审计源码（硬编码密钥、弱加密等）
- 通过 frida 动态 Hook（SSL Pinning 绕过、参数篡改）
- 通过 burp 修改重放请求（鉴权绕过、越权测试）
4. 漏洞验证
- 构造恶意输入，验证漏洞
- 截图记录漏洞证据
- 生成 PoC
5. 输出
- 安卓专项渗透报告
- 包含截图、流量、代码审计结果
参考文档
references/android-authorized-app-pentest-sop.md— 安卓 App 渗透 SOPreferences/android-external-url-runtime-first-workflow.md— 安卓外部 URL 测试references/android-ui-driven-observation-and-packet-loop.md— UI 驱动观察循环references/android-network-layer-testing-quick-reference.md— 网络层测试速查references/android-signing-and-crypto-workflow.md— 签名与加密工作流references/android-static-triage-and-callflow.md— 静态分层与调用链references/android-dynamic-hooking-and-replay.md— 动态 Hook 与重放
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/android-authorized-app-pentest-sop.md 5.4 KB
- references/android-dynamic-hooking-and-replay.md 2.2 KB
- references/android-external-url-runtime-first-workflow.md 8.7 KB
- references/android-native-signature-analysis.md 1.1 KB
- references/android-network-layer-testing-quick-reference.md 5.0 KB
- references/android-signature-reverse-template.md 2.1 KB
- references/android-signing-and-crypto-workflow.md 7.4 KB
- references/android-static-triage-and-callflow.md 1.5 KB
- references/android-ui-driven-observation-and-packet-loop.md 9.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 61 lines · 32 tokens per session scan A cd6fe4453d74
android-pentest is a skill published in the GitHub repository fb0sh/pentester (23 stars, last pushed 1mo ago), licensed MIT. It adds 32 tokens to every session and 670 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to android-pentest, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
mobile-security
Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC, storage, crypto, signing), dynamic analysis (Frida/objection, TLS-pinning + root/jailbreak bypass, traffic interception)…
transilience-report-style
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
firewall-review
Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped…
pentest-engagement
Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500…
attack-path-stitcher
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
coordination
Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.