Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/unclecheng-li/deepsec/android-pentestnpx skills add Unclecheng-li/DeepSec --skill android-pentestgit clone --depth 1 https://github.com/Unclecheng-li/DeepSecWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unclecheng-li/deepsec/android-pentest)<a href="https://agentmods.dev/skills/unclecheng-li/deepsec/android-pentest"><img src="https://agentmods.dev/badge/skills/unclecheng-li/deepsec/android-pentest.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00032 | $0.00670 |
| Opus 5 | $0.00016 | $0.00335 |
| Sonnet 5 | $0.00006 | $0.00134 |
| Haiku 4.5 | $0.00003 | $0.00067 |
Grade A, and why
android-pentest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to android-pentest — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
安卓应用渗透测试 Skill
针对安卓应用的专项渗透测试，遵循 runtime-first 原则：先运行态驱动、先抓包，最后才逆向。
需要更深入的客户端逆向知识？ 使用 client-reverse Skill，包含完整的签名恢复、加密还原、Burp 重放工作流。
核心原则
不要先逆向 APK。默认操作顺序：
- 确认目标 App 已安装在连接设备上
- 准备好 Burp 或 Charles 抓包
- 用 scrcpy_vision 驱动真实业务流程
- 每个关键动作后检查抓包状态
- 包可见且可重放 → 直接做 Web/API 安全测试
- 只有抓不到包/包被加密时 → 升级到 jadx/frida/ida
1. 环境准备
- 通过 adb-mcp 连接设备/模拟器
- 通过 jadx 反编译目标 APK
- 通过 burp-mcp 配置代理抓包
2. 自动化探索
- 启动 APP，通过 adb-mcp 自动截图
- 通过 frida-mcp Hook 关键函数
- 通过 burp-mcp 捕获和分析数据流
- 自动点击 UI 元素，遍历功能点
- 模拟用户行为，识别敏感数据流
3. 深度分析
- 通过 jadx 审计源码（硬编码密钥、弱加密等）
- 通过 frida 动态 Hook（SSL Pinning 绕过、参数篡改）
- 通过 burp 修改重放请求（鉴权绕过、越权测试）
4. 漏洞验证
- 构造恶意输入，验证漏洞
- 截图记录漏洞证据
- 生成 PoC
5. 输出
- 安卓专项渗透报告
- 包含截图、流量、代码审计结果
参考文档
references/android-authorized-app-pentest-sop.md— 安卓 App 渗透 SOPreferences/android-external-url-runtime-first-workflow.md— 安卓外部 URL 测试references/android-ui-driven-observation-and-packet-loop.md— UI 驱动观察循环references/android-network-layer-testing-quick-reference.md— 网络层测试速查references/android-signing-and-crypto-workflow.md— 签名与加密工作流references/android-static-triage-and-callflow.md— 静态分层与调用链references/android-dynamic-hooking-and-replay.md— 动态 Hook 与重放
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/android-authorized-app-pentest-sop.md 5.4 KB
- references/android-dynamic-hooking-and-replay.md 2.2 KB
- references/android-external-url-runtime-first-workflow.md 8.7 KB
- references/android-native-signature-analysis.md 1.1 KB
- references/android-network-layer-testing-quick-reference.md 5.0 KB
- references/android-signature-reverse-template.md 2.1 KB
- references/android-signing-and-crypto-workflow.md 7.4 KB
- references/android-static-triage-and-callflow.md 1.5 KB
- references/android-ui-driven-observation-and-packet-loop.md 9.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 61 lines · 32 tokens per session scan A cd6fe4453d74
android-pentest is a skill published in the GitHub repository Unclecheng-li/DeepSec (386 stars, last pushed 10d ago), licensed MIT. It adds 32 tokens to every session and 670 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to android-pentest, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
SwiftUI
SwiftUI patterns, view composition, styling, and reusable UI elements.
Swift
Swift and iOS development with modern patterns and best practices.
edge-device-exploitation
Edge device exploitation — routers, firewalls, VPN appliances (Cisco IOS XE, Fortinet, Ivanti, Palo Alto). Covers CVE exploitation chains, post-exploitation on network devices, config extraction, and implant deployment on perimeter infrastructure.
analyzing-android-malware-with-apktool
Use when perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection. Use when performing static analysis of android apk malware samples using apktool.
analyzing-ios-app-security-with-objection
Use when performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that enables security testers to interact with app internals without jailbreaking. Use when assessing iOS app security posture, bypassing client-side protections, dumping keychain items, inspecting…
analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.