Mobile-ReverseSkill

Reusable Agent Skills for mobile reverse engineering & native fuzzing — native support for Claude Code, opencode, Codex, Gemini CLI, Cursor, Copilot, Windsurf, Amp, Crush & ZCode: works straight after git clone.

Skills

Workflow

All dynamic testing stays on an isolated device or emulator, traffic is limited to an
authorized/local backend, and fuzzing targets local libraries rather than production services.

Component connections

The canonical files define behavior once; provider copies only adapt that behavior to each
agent's native format. At runtime, the agent combines skills and commands with local scripts,
Frida helpers, and optional MCP interfaces, then feeds evidence back into the next analysis pass.

Provider support

Skills, slash commands, and the agent guide ship in each tool's native format —
generated from the canonical sources (skills/, commands/, AGENTS.md) by
scripts/sync-providers.sh and committed, so a plain
git clone needs zero setup:

.agents/ is the cross-tool convention most agents already scan; Claude Code (and its
.claude/ mirror) and Gemini's TOML commands are the exceptions handled by the sync.

Install

Quick install — skills + slash commands into every agent (one command, usable in
any project afterwards):

curl -fsSL https://raw.githubusercontent.com/alvinhayy/Mobile-ReverseSkill/main/scripts/quick-install.sh | bash

Or target specific providers only — pass names after -s -- (valid: all claude codex opencode zcode cursor gemini copilot windsurf):

# Codex only
curl -fsSL https://raw.githubusercontent.com/alvinhayy/Mobile-ReverseSkill/main/scripts/quick-install.sh | bash -s -- codex

# Codex + Claude Code
curl -fsSL https://raw.githubusercontent.com/alvinhayy/Mobile-ReverseSkill/main/scripts/quick-install.sh | bash -s -- codex claude

Equivalent without curl-piping (clone + install; the temp clone is removed
whether the install succeeds or fails — note the ; before rm):

git clone --depth 1 https://github.com/alvinhayy/Mobile-ReverseSkill /tmp/Mobile-ReverseSkill \
  && /tmp/Mobile-ReverseSkill/scripts/quick-install.sh; rm -rf /tmp/Mobile-ReverseSkill

Or keep the clone and install from it (reusable, nothing to clean up):

git clone https://github.com/alvinhayy/Mobile-ReverseSkill \
  && ./Mobile-ReverseSkill/scripts/quick-install.sh

What it installs user-globally:

In-repo (every agent): clone and open the repo — skills, commands, and the guide
are already in each tool's native directories.

git clone https://github.com/alvinhayy/Mobile-ReverseSkill

User-global (same as the quick install, from an existing clone — optional provider names):

scripts/sync-providers.sh --user           # every provider
scripts/sync-providers.sh --user codex     # Codex only (skills + prompts)

Per-skill via skillfish (skills only):

npx skillfish add alvinhayy/Mobile-ReverseSkill afl-fuzzing
npx skillfish add alvinhayy/Mobile-ReverseSkill reverse-engineer
# or from a clone (reads skillfish.json): npx skillfish install

skills/ + commands/ are the sources of truth. Everything else is generated —
edit canonical files, run scripts/sync-providers.sh, and commit. --check
reports drift (CI-friendly).

Slash commands

Canonical source: commands/*.md (frontmatter description + argument-hint,
$ARGUMENTS placeholder), synced into every provider's command dir — see the
matrix above. To use them outside this repo, install user-globally with
scripts/sync-providers.sh --user.

Interactive / long-running steps open in a new tab

Commands that need a live CLI (frida REPL, emulator boot, frida-server, a fuzz campaign)
launch it in a new terminal tab via scripts/run-in-tab.sh <label> "<command>" so you can
watch and interact — while the whole session is mirrored to ~/.mre-runs/<label>-<ts>.log, which
the agent tails to keep monitoring. Uses script -q (TTY preserved, so the frida REPL still
works). If macOS Automation isn't granted (first use prompts: System Settings → Privacy &
Security → Automation → allow your terminal to control iTerm), it falls back to a logged
background run — the process still runs and stays monitorable. Standalone:

scripts/run-in-tab.sh frida "frida -U -f com.example.targetapp -l runtime/flutter-tls.js"
tail -f ~/.mre-runs/frida-*.log

Tooling & multi-stack (staged)

Static-analysis + decompiler toolchain covering Android · Flutter · React Native · iOS
(+ cross disassemblers). Detect the framework, then run its pipeline — each tool writes to its
own <tool>_out/ folder (git-ignored: holds decompiled target code).

scripts/install-tools.sh --stack <android|flutter|rn|ios|cross> --check   # audit availability
scripts/detect-stack.sh   app.apk        # flutter|react-native|unity|xamarin|cordova|native

scripts/analyze-android.sh app.apk  out/app   # jadx, apktool, baksmali, dex2jar, dexdump, strings
scripts/analyze-flutter.sh app.xapk out/app   # r2flutter metadata + blutter pseudo-source
scripts/analyze-rn.sh      app.apk  out/app   # Hermes (hermes-dec/hbctool) or JSC (rn-decompiler)
scripts/analyze-ios.sh     app.ipa  out/app   # Info.plist, entitlements, otool/nm, class-dump, swift-demangle

Full matrix + per-stack notes: docs/TOOLING.md.

Repository layout

commands/               canonical slash commands (13) — source of truth
skills/
  afl-fuzzing/         SKILL.md + harness/ + scripts/ + README.md (full method writeup)
  mobile-vuln-hunt/    SKILL.md + semgrep/android-taint.yaml (rg + taint vuln-class scan)
  reverse-engineer/    SKILL.md + references/r2flutter.md
.claude/ · .opencode/ · .agents/ · .cursor/ · .github/ · .gemini/ · .windsurf/
                        per-provider skills/commands/prompt dirs — GENERATED by
                        scripts/sync-providers.sh (committed so a clone works everywhere)
AGENTS.md               canonical agent guide (imported by CLAUDE.md / GEMINI.md wrappers)
opencode.json           opencode integration (loaded docs + MCP)
scripts/                 detect-stack, analyze-{android,flutter,rn,ios}, attack-surface,
                         merge-apks, patch-apk, install-tools, run-in-tab, fuzz-source,
                         rebuild, sync-providers
runtime/               Frida templates — SSL/pinning (ssl-pinning-universal, flutter-tls*,
                       ios-bypass), root/JB/anti-debug (android-root-bypass, flutter-jb-root-bypass,
                       android-antidebug, emu-bypass), recon (rn-frida-hook, crypto-dump,
                       registernatives-dump) — set your own target package
docs/
  ROADMAP.md           backlog / gap-analysis status
  WORKFLOW.md          end-to-end workflow + OWASP MASTG checklist
  vuln-classes-android.md · vuln-classes-ios.md   58 vuln classes: root cause /
                       grep signature / PoC / fix (adapted from Niraj Kharel's series)
  research/mobile-pentesting/   full-text verbatim archive of the 65-post source series
                       (included with the author's permission for open-source use)
  TOOLING.md           per-stack toolchain matrix (+ iOS lab tooling)
  MCP-SETUP.md         device-automation MCP (uiautomator2) + Burp CA routes
  bypass-reference.md · frida-objection.md   root/JB/anti-debug/SSL + Frida/Objection/RMS
  react-native.md · flutter.md               RN & Flutter static + dynamic + TLS
  ios-reversing.md · ios-nojailbreak.md       iOS RE + non-jailbreak pipeline
  attack-surface.md · commercial-protectors.md   IPC/loot + Appdome-style bypass

Frida runtime helpers (runtime/)

Generic Frida templates for dynamic analysis. The target package is a placeholder
com.example.targetapp — replace it with the app you are authorized to test:

frida -U -f com.example.targetapp -l runtime/flutter-tls.js

Highlights: flutter-tls*.js (Flutter/BoringSSL TLS unpinning), emu-bypass.js
(emulator-detection bypass), approov-*.js (attestation/pinning probes),
rasp-*.js (RASP neutralisation patterns), *-spoof.js (device identity spoofing).

Runtime device automation (MCP)

Dynamic analysis drives the app on a device — launch it, dump the UI tree, tap through flows,
and reach the screen that triggers the code under test (open the QR scanner, walk an auth flow
while a Frida script is attached). This uses uiautomator2-mcp
by @fdciabdul:

git clone https://github.com/fdciabdul/uiautomator2-mcp.git
cd uiautomator2-mcp && python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
claude mcp add --transport stdio uiautomator2 -- $PWD/.venv/bin/python $PWD/server.py

Full setup + config for other MCP clients: docs/MCP-SETUP.md.

Rooting a test AVD

• macOS / Apple Silicon (arm64) → KernelSU via
  alvinhayy/Mobile-Pentest-Setup:
  ./create-avd.sh --name lab1 --api 36 --full
• x86_64 → Magisk via newbit/rootAVD:
  ./rootAVD.sh system-images/android-<API>/<tag>/x86_64/ramdisk.img

See docs/WORKFLOW.md for the full toolchain and step-by-step flow.

⚠ Authorized use only

These skills are for authorized security research: apps you own, or engagements you are
contracted/permitted to run, or CTF/education. Keep the target's identity, real domains, and
raw findings in your private report — never commit them here. All fuzzing runs offline on a
local emulator/device; nothing targets third-party production infrastructure.

Credits & license

• afl-fuzzing builds on AFL++ (AGPL-3.0) and the
  Trail of Bits aflpp skill.
• reverse-engineer — original full-methodology skill maintained in this repo
  (skills/reverse-engineer/).

Original content in this repository (harnesses, scripts, skill docs) is MIT — see
LICENSE. Bundled/referenced upstream tools keep their own licenses.