VulnClaw is an AI-driven command-line penetration-testing agent that turns natural-language instructions into an automated workflow for reconnaissance, vulnerability discovery, exploitation, and report generation. It is intended for authorized penetration tests, CTF competitions, security teaching, and red-team exercises, using LLMs and MCP tools. The catalogue contains its specialized skills for security-testing tasks.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Netw0rkNoob/VulnClaw --skill android-pentestgit clone --depth 1 https://github.com/Netw0rkNoob/VulnClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/netw0rknoob/vulnclaw/android-pentest)<a href="https://agentmods.dev/skills/netw0rknoob/vulnclaw/android-pentest"><img src="https://agentmods.dev/badge/skills/netw0rknoob/vulnclaw/android-pentest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/netw0rknoob/vulnclaw/android-pentest"><img src="https://agentmods.dev/badge/skills/netw0rknoob/vulnclaw/android-pentest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00670 |
| Opus 5 | $0.00016 | $0.00335 |
| Sonnet 5 | $0.00006 | $0.00134 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
android-pentest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
2 near-identical copies found in the catalogue:
- android-pentest — 100% identical, 0 lines differ
- android-pentest — 100% identical, 0 lines differ
What it actually says
安卓应用渗透测试 Skill
针对安卓应用的专项渗透测试，遵循 runtime-first 原则：先运行态驱动、先抓包，最后才逆向。
需要更深入的客户端逆向知识？ 使用 client-reverse Skill，包含完整的签名恢复、加密还原、Burp 重放工作流。
核心原则
不要先逆向 APK。默认操作顺序：
- 确认目标 App 已安装在连接设备上
- 准备好 Burp 或 Charles 抓包
- 用 scrcpy_vision 驱动真实业务流程
- 每个关键动作后检查抓包状态
- 包可见且可重放 → 直接做 Web/API 安全测试
- 只有抓不到包/包被加密时 → 升级到 jadx/frida/ida
1. 环境准备
- 通过 adb-mcp 连接设备/模拟器
- 通过 jadx 反编译目标 APK
- 通过 burp-mcp 配置代理抓包
2. 自动化探索
- 启动 APP，通过 adb-mcp 自动截图
- 通过 frida-mcp Hook 关键函数
- 通过 burp-mcp 捕获和分析数据流
- 自动点击 UI 元素，遍历功能点
- 模拟用户行为，识别敏感数据流
3. 深度分析
- 通过 jadx 审计源码（硬编码密钥、弱加密等）
- 通过 frida 动态 Hook（SSL Pinning 绕过、参数篡改）
- 通过 burp 修改重放请求（鉴权绕过、越权测试）
4. 漏洞验证
- 构造恶意输入，验证漏洞
- 截图记录漏洞证据
- 生成 PoC
5. 输出
- 安卓专项渗透报告
- 包含截图、流量、代码审计结果
参考文档
references/android-authorized-app-pentest-sop.md— 安卓 App 渗透 SOPreferences/android-external-url-runtime-first-workflow.md— 安卓外部 URL 测试references/android-ui-driven-observation-and-packet-loop.md— UI 驱动观察循环references/android-network-layer-testing-quick-reference.md— 网络层测试速查references/android-signing-and-crypto-workflow.md— 签名与加密工作流references/android-static-triage-and-callflow.md— 静态分层与调用链references/android-dynamic-hooking-and-replay.md— 动态 Hook 与重放
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/android-authorized-app-pentest-sop.md 5.4 KB
- references/android-dynamic-hooking-and-replay.md 2.2 KB
- references/android-external-url-runtime-first-workflow.md 8.7 KB
- references/android-native-signature-analysis.md 1.1 KB
- references/android-network-layer-testing-quick-reference.md 5.0 KB
- references/android-signature-reverse-template.md 2.1 KB
- references/android-signing-and-crypto-workflow.md 7.4 KB
- references/android-static-triage-and-callflow.md 1.5 KB
- references/android-ui-driven-observation-and-packet-loop.md 9.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 61 lines · 32 tokens per session scan A cd6fe4453d74
android-pentest is a skill published in the GitHub repository Netw0rkNoob/VulnClaw (3,284 stars, last pushed 4d ago), licensed MIT. It adds 32 tokens to every session and 670 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
apk-reverse
A command-line workflow for examining Android application packages, including decompiling code, inspecting smali and native libraries, modifying files, and rebuilding packages. An APK is the installable file used to distribute an Android app.
mobile-reverse
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
competition-android-hooking
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries…
competition-ios-runtime
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for IPA runtime analysis, Frida hooks, Objective-C or Swift method tracing, Keychain inspection, SSL pinning bypass, URL scheme handling, and iOS request-signing recovery. Use when the user asks to hook an IPA, trace Objective-C or Swift…
competition-crypto-mobile
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or…
analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.