How do I install the Mobile Android Assessment skill?

Run npx skillmds@latest add noorqureshi/mobile-android-assessment in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Mobile Android Assessment safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Mobile Android Assessment?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Mobile Android Assessment free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Mobile Android Assessment?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Mobile Android Assessment by noorqureshi

Name: Mobile Android Assessment
Author: NoorQureshi

Mobile Android Assessment

Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.

NoorQureshi Updated Sep 17, 2026

File contents

Android app assessment

When it applies

You have an APK (or a device/emulator running the app) and program scope covers the mobile client + its backend. Most impactful mobile bugs are really API bugs the app exposes, plus local data/secret leaks.

Why it works

Client apps ship their logic and often their secrets. Decompilation reveals endpoints, keys, and auth flows; exported components and WebViews expose attack surface; and the app trusts its own device, so runtime instrumentation removes checks the server assumed were enforced.

Method

Unpack & triage: apktool d app.apk (resources/manifest) and jadx-gui app.apk (readable Java). Read AndroidManifest.xml for exported=true activities/services/ receivers/providers, android:debuggable, custom URL schemes, and usesCleartextTraffic.
Hunt secrets & endpoints: grep decompiled code + res/ + strings.xml for API keys, base URLs, firebase configs, tokens (grep -rniE "api[_-]?key|secret|https?://").
Local storage review: after use, pull /data/data/<pkg>/ (shared_prefs, sqlite, files) for tokens/PII stored in cleartext.
Dynamic: run under Frida/objection — objection -g <pkg> explore to dump keystore, bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.
Exported components: invoke exported activities/providers via adb shell am start/ content query to reach functionality without auth.

Gotchas

Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.
Cert pinning blocks proxying → see mobile-cert-pinning-bypass before concluding "no traffic".
The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.

Verify success

A concrete impact: leaked working credential/endpoint, unauthenticated reach into an exported component, or a backend bug proven through the app's traffic.

References

OWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.

---name: mobile-android-assessmentdescription: Assess an Android app (static + dynamic). Load when the target is an APK/AAB, a mobile bug-bounty scope, or "test the android app". Signals: .apk file, Java/Kotlin/Smali, AndroidManifest.xml, exported components, WebViews, hardcoded secrets, Frida/objection.---# Android app assessment## When it appliesYou have an APK (or a device/emulator running the app) and program scope covers the mobileclient + its backend. Most impactful mobile bugs are really API bugs the app exposes, pluslocal data/secret leaks.## Why it worksClient apps ship their logic and often their secrets. Decompilation reveals endpoints, keys,and auth flows; exported components and WebViews expose attack surface; and the app trusts itsown device, so runtime instrumentation removes checks the server assumed were enforced.## Method1. **Unpack & triage**: `apktool d app.apk` (resources/manifest) and `jadx-gui app.apk` (readable Java). Read `AndroidManifest.xml` for `exported=true` activities/services/ receivers/providers, `android:debuggable`, custom URL schemes, and `usesCleartextTraffic`.2. **Hunt secrets & endpoints**: grep decompiled code + `res/` + `strings.xml` for API keys, base URLs, firebase configs, tokens (`grep -rniE "api[_-]?key|secret|https?://"`).3. **Local storage review**: after use, pull `/data/data/<pkg>/` (shared_prefs, sqlite, files) for tokens/PII stored in cleartext.4. **Dynamic**: run under Frida/objection — `objection -g <pkg> explore` to dump keystore, bypass root/emulator checks, and hook methods. Proxy traffic (Burp) to test the backend.5. **Exported components**: invoke exported activities/providers via `adb shell am start`/ `content query` to reach functionality without auth.## Gotchas- Cleartext-secret finding needs impact — a key with no privilege is informational; tie it to an action.- Cert pinning blocks proxying → see `mobile-cert-pinning-bypass` before concluding "no traffic".- The real bugs are usually server-side (BOLA/mass-assignment) reached via the app — proxy and test the API.## Verify successA concrete impact: leaked working credential/endpoint, unauthenticated reach into an exportedcomponent, or a backend bug proven through the app's traffic.## ReferencesOWASP MASVS/MASTG; OWASP Mobile Top 10 (2024); jadx/objection docs.

Frequently asked questions