About

Imported from cyberful/cyberful (cyberful/builtin/skills/assess-mobile-security/SKILL.md). Install upstream with npx skills add cyberful/cyberful --skill assess-mobile-security. Copyright stays with the author.

Assess Mobile Security

Name: assess-mobile-security
Author: cyberful

Establish the Mobile Trust Model

Define app identifiers, signing identities, distribution channel, minimum and target OS, device integrity assumptions, user roles, backend environments, third-party SDKs, deep-link domains, extensions, companion apps, and sensitive capabilities.

Keep client and backend boundaries separate. A mobile control can raise extraction or tampering cost, but server authorization must remain correct when the client is modified.

Use MASVS and MASTG as coverage indexes, then adapt tests to the application's actual architecture. Read android-review.md, ios-review.md, and mobile-network-storage-resilience.md as applicable.

Correlate Static and Dynamic Evidence

Inventory packages, components, entitlements, permissions, URL handlers, SDKs, native libraries, and build configuration.
Trace sensitive data and credentials through storage, logs, IPC, memory, network, backups, notifications, and screenshots.
Exercise authentication, enrollment, device binding, recovery, offline state, and account switching.
Observe actual runtime behavior under normal, instrumented, proxied, background, locked, restored, and upgraded states.
Replay the same API paths outside the app to validate server-side controls.

Static declarations and runtime behavior routinely diverge because of feature flags, remote config, SDK initialization, OS version, and build flavor.

Test Platform Boundaries

Review exported components, deep and universal links, pasteboard or clipboard, file providers, content providers, app extensions, intents, custom URL schemes, WebViews, JavaScript bridges, local servers, push notifications, widgets, and cross-app authentication brokers.

For each entry point, determine who can invoke it, which identity it uses, what inputs select resources or actions, and whether invocation works while locked, logged out, or in another tenant.

Evaluate Resilience Against the Threat Model

Review signing, update channel, anti-tamper, root or jailbreak detection, debugger and instrumentation resistance, integrity APIs, obfuscation, and secret extraction only against explicitly required resilience goals. Treat bypass resistance as layered cost, not as a server-side access control.

Report End-to-End Impact

Document build and OS, device state, static location, runtime sequence, backend request, platform boundary, data or action obtained, and whether the condition survives a modified client. Map findings to the applicable MASVS control family without letting the taxonomy replace evidence.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberful-cyberful-assess-mobile-security/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberful-cyberful-assess-mobile-security.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberful-cyberful-assess-mobile-security",
  "kind": "skill",
  "name": "assess-mobile-security",
  "description": "Assess Android and iOS applications through coordinated static, dynamic, backend, platform, and resilience analysis. Use for mobile app security assessments covering storage, cryptography, authentication, network communication, deep links, IPC, WebViews, platform permissions, biometrics, code loading, update integrity, reverse engineering, tampering, device compromise assumptions, and MASVS or MASTG-aligned coverage.",
  "publisher": "cyberful",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "android",
      "ios",
      "owasp-masvs",
      "owasp-mastg",
      "mobile-backend",
      "application-resilience",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Assess Android and iOS applications through coordinated static, dynamic, backend, platform, and resilience analysis. Use for mobile app security assessments covering storage, cryptography, authentication, network communication, deep links, IPC, WebViews, platform permissions, biometrics, code loading, update integrity, reverse engineering, tampering, device compromise assumptions, and MASVS or MASTG-aligned coverage."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/cyberful/cyberful",
      "path": "cyberful/builtin/skills/assess-mobile-security/SKILL.md",
      "ref": "ec598a6d48580f997cdd00766692493df7390e16",
      "url": "https://github.com/cyberful/cyberful/blob/ec598a6d48580f997cdd00766692493df7390e16/cyberful/builtin/skills/assess-mobile-security/SKILL.md",
      "key": "cyberful/cyberful/cyberful/builtin/skills/assess-mobile-security/SKILL.md"
    }
  },
  "instructions": "# Assess Mobile Security\n\n## Establish the Mobile Trust Model\n\nDefine app identifiers, signing identities, distribution channel, minimum and target OS, device integrity assumptions, user roles, backend environments, third-party SDKs, deep-link domains, extensions, companion apps, and sensitive capabilities.\n\nKeep client and backend boundaries separate. A mobile control can raise extraction or tampering cost, but server authorization must remain correct when the client is modified.\n\nUse MASVS and MASTG as coverage indexes, then adapt tests to the application's actual architecture. Read [android",
  "cost": {
    "context_tokens": 674
  }
}

Fetch it by URL: GET /api/v1/registry/cyberful-cyberful-assess-mobile-security/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.