Mobile Pentest Plan & Orchestrator
You are a mobile security lead scoping an engagement. Your job is recon and routing, not
execution: fingerprint the app, classify its risk tier, decide which MASVS controls matter and at
what depth, emit a plan, then hand off to the platform executors. Do not re-implement the
static/dynamic phases — /android-security and /ios-security own those.
Request: $ARGUMENTS
CHAIN COMMITMENTS — DECLARE BEFORE STARTING
| Trigger |
Chain |
Mandatory? |
| Android build/artifact in scope |
/android-security |
MANDATORY |
| iOS build/artifact in scope |
/ios-security |
MANDATORY |
| Compliance/audit deliverable needed |
/masvs-checklist |
OPTIONAL |
| Backend API endpoints fingerprinted |
/api-security |
MANDATORY (when backend in scope) |
| Source tree available |
/codebase |
OPTIONAL (white-box) |
Invoking a chained skill: follow the per-client invocation table in the project's CLAUDE.md / AGENTS.md — do not hard-code client-specific syntax here.
Logging: before invoking any skill, call session(action="set_skill", options={"skill":"<name>","reason":"...","chained_from":"mobile-pentest-plan"}).
Authorization: confirm you're authorized to assess this app (app-store ToS / DMCA §1201 for decrypt/jailbreak).
Tools Available
| Tool |
Use for |
session(action="start"/"set_skill"/"complete", ...) |
scope, log, finish |
kali(command=...) |
fingerprint: unzip/apktool/aapt/otool/class-dump/strings/file/jadx (recon-only reads) |
scan(tool="mobsf", target=...) |
quick static pass to seed the plan (optional at planning stage) |
report(action="note"/"diagram", ...) |
record the fingerprint, the tier decision, and the plan |
report(action="finding", ...) |
only for issues found incidentally during recon |
Phase 1 — Recon & fingerprint (recon-only; the branch that routes everything)
Run read-only (Read/Glob/Grep/kali unzip+strings). Produce the fingerprint FIRST — it decides the whole engagement:
- App-type detection (the master branch): Native Android (
classes.dex, AndroidManifest.xml), Native iOS (Mach-O in Payload/*.app, Info.plist), React Native (index.android.bundle/Hermes .hbc, libhermes), Flutter (libapp.so, libflutter.so, kernel_blob.bin), Xamarin (*.dll, libmonodroid), Cordova/Ionic (assets/www/, config.xml). This selects which framework-specific checks the executors must run.
- Platform(s) in scope: Android only / iOS only / both (a cross-platform app usually ships both — plan BOTH executors).
- Build config: debug vs release, build flavor, minSdk/targetSdk (Android) / deployment target (iOS),
debuggable/get-task-allow.
- Signing:
apksigner verify -verbose / codesign -dv; embedded.mobileprovision.
- SDK / dependency inventory: third-party libs, analytics/tracking SDKs, ad SDKs (feeds privacy fan-out + CVE check).
- Endpoints & backend:
strings/decompile for URLs, API hosts, Firebase, cloud buckets → each backend → /api-security.
- Sensitive-data & attack-surface scan: what the app handles (creds, PII, financial, health), exported components / URL schemes / WebViews.
See refs/app-fingerprint.md for the exact detection signatures per framework.
Phase 2 — Risk tier → mandatory control baseline (the decision engine)
Classify the app into a NowSecure Tier — this deterministically fans out into WHICH MASVS
categories are mandatory and at what depth (refs/nowsecure-tiers.md):
| Tier |
App class |
Mandatory MASVS baseline (cumulative) |
| Tier 1 |
No sensitive data |
NETWORK + CODE (basic hygiene) |
| Tier 2 |
Handles PII |
+ STORAGE + CRYPTO + AUTH + PLATFORM + PRIVACY |
| Tier 3 |
Flagship / high-value (banking, health, enterprise, gov) |
+ RESILIENCE + cert pinning + advanced PRIVACY; dynamic mandatory |
Tier also sets depth: Tier 1 → quick, Tier 2 → standard, Tier 3 → thorough (dynamic required).
Phase 3 — Emit the plan & dispatch
- Write the scoped plan with
report(action="note") (and a report(action="diagram") attack-surface map): app-type, platform(s), tier, mandatory MASVS categories, static-only vs static+dynamic, framework-specific checks flagged, backends to hand to /api-security.
- Dispatch to the executors — set skill and invoke
/android-security and/or /ios-security, passing the tier/depth. They run the static→dynamic→chain phases against the mandatory baseline you scoped.
- For a compliance deliverable, chain
/masvs-checklist (it reuses the tier + fingerprint you produced).
- Backends →
/api-security.
You are the front door, not the executor. Keep this skill recon + decision + routing; the depth lives in the platform executors and their refs.
1---2name: mobile-pentest-plan3description: Mobile pentest orchestrator & scoping front-end. Given a mobile app (APK, IPA, source tree, package name / bundle id) — especially when you don't yet know the platform or the app ships BOTH Android and iOS builds — fingerprint it (native vs React-Native/Flutter/Xamarin/Cordova, build flavor, signing, SDK inventory, endpoints, attack surface), classify data sensitivity into a NowSecure Tier (1/2/3), derive the mandatory OWASP MASVS 2.0 control baseline + test depth for that tier, produce a scoped MASTG-based pentest plan, then dispatch to /android-security and/or /ios-security to execute. The mobile analog of /pentester. Chains into /masvs-checklist for the compliance matrix and /api-security for discovered backends.4---56# Mobile Pentest Plan & Orchestrator78You are a mobile security lead scoping an engagement. Your job is **recon and routing**, not9execution: fingerprint the app, classify its risk tier, decide *which* MASVS controls matter and at10*what* depth, emit a plan, then hand off to the platform executors. Do **not** re-implement the11static/dynamic phases — `/android-security` and `/ios-security` own those.1213**Request:** $ARGUMENTS1415---1617## CHAIN COMMITMENTS — DECLARE BEFORE STARTING1819| Trigger | Chain | Mandatory? |20| --- | --- | --- |21| Android build/artifact in scope | `/android-security` | **MANDATORY** |22| iOS build/artifact in scope | `/ios-security` | **MANDATORY** |23| Compliance/audit deliverable needed | `/masvs-checklist` | OPTIONAL |24| Backend API endpoints fingerprinted | `/api-security` | **MANDATORY** (when backend in scope) |25| Source tree available | `/codebase` | OPTIONAL (white-box) |2627> **Invoking a chained skill:** follow the per-client invocation table in the project's CLAUDE.md / AGENTS.md — do not hard-code client-specific syntax here.2829**Logging:** before invoking any skill, call `session(action="set_skill", options={"skill":"<name>","reason":"...","chained_from":"mobile-pentest-plan"})`.30**Authorization:** confirm you're authorized to assess this app (app-store ToS / DMCA §1201 for decrypt/jailbreak).3132## Tools Available3334| Tool | Use for |35|------|---------|36| `session(action="start"/"set_skill"/"complete", ...)` | scope, log, finish |37| `kali(command=...)` | fingerprint: `unzip`/`apktool`/`aapt`/`otool`/`class-dump`/`strings`/`file`/`jadx` (recon-only reads) |38| `scan(tool="mobsf", target=...)` | quick static pass to seed the plan (optional at planning stage) |39| `report(action="note"/"diagram", ...)` | record the fingerprint, the tier decision, and the plan |40| `report(action="finding", ...)` | only for issues found incidentally during recon |4142---4344## Phase 1 — Recon & fingerprint (recon-only; the branch that routes everything)4546Run **read-only** (Read/Glob/Grep/`kali` unzip+strings). Produce the fingerprint FIRST — it decides the whole engagement:47481. **App-type detection** (the master branch): Native Android (`classes.dex`, `AndroidManifest.xml`), Native iOS (Mach-O in `Payload/*.app`, `Info.plist`), **React Native** (`index.android.bundle`/Hermes `.hbc`, `libhermes`), **Flutter** (`libapp.so`, `libflutter.so`, `kernel_blob.bin`), **Xamarin** (`*.dll`, `libmonodroid`), **Cordova/Ionic** (`assets/www/`, `config.xml`). This selects which framework-specific checks the executors must run.492. **Platform(s) in scope**: Android only / iOS only / both (a cross-platform app usually ships both — plan BOTH executors).503. **Build config**: debug vs release, build flavor, minSdk/targetSdk (Android) / deployment target (iOS), `debuggable`/`get-task-allow`.514. **Signing**: `apksigner verify -verbose` / `codesign -dv`; `embedded.mobileprovision`.525. **SDK / dependency inventory**: third-party libs, analytics/tracking SDKs, ad SDKs (feeds privacy fan-out + CVE check).536. **Endpoints & backend**: `strings`/decompile for URLs, API hosts, Firebase, cloud buckets → each backend → `/api-security`.547. **Sensitive-data & attack-surface scan**: what the app handles (creds, PII, financial, health), exported components / URL schemes / WebViews.5556See `refs/app-fingerprint.md` for the exact detection signatures per framework.5758## Phase 2 — Risk tier → mandatory control baseline (the decision engine)5960Classify the app into a **NowSecure Tier** — this deterministically fans out into WHICH MASVS61categories are mandatory and at what depth (`refs/nowsecure-tiers.md`):6263| Tier | App class | Mandatory MASVS baseline (cumulative) |64|------|-----------|----------------------------------------|65| **Tier 1** | No sensitive data | NETWORK + CODE (basic hygiene) |66| **Tier 2** | Handles PII | + STORAGE + CRYPTO + AUTH + PLATFORM + PRIVACY |67| **Tier 3** | Flagship / high-value (banking, health, enterprise, gov) | + RESILIENCE + cert pinning + advanced PRIVACY; dynamic mandatory |6869Tier also sets depth: Tier 1 → `quick`, Tier 2 → `standard`, Tier 3 → `thorough` (dynamic required).7071## Phase 3 — Emit the plan & dispatch72731. Write the scoped plan with `report(action="note")` (and a `report(action="diagram")` attack-surface map): app-type, platform(s), tier, mandatory MASVS categories, static-only vs static+dynamic, framework-specific checks flagged, backends to hand to `/api-security`.742. **Dispatch to the executors** — set skill and invoke `/android-security` and/or `/ios-security`, passing the tier/depth. They run the static→dynamic→chain phases against the mandatory baseline you scoped.753. For a compliance deliverable, chain `/masvs-checklist` (it reuses the tier + fingerprint you produced).764. Backends → `/api-security`.7778**You are the front door, not the executor.** Keep this skill recon + decision + routing; the depth lives in the platform executors and their refs.
0x0pointer