Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This skill provides mobile security researchers with a comprehensive workflow for analyzing Android applications. It integrates static analysis and dynamic instrumentation to identify vulnerabilities through source-to-sink tracing, manifest review, and the detection of hardcoded secrets.
The toolkit streamlines complex tasks such as bypassing SSL pinning, testing intent injection, and analyzing deep link abuse. It supports the full audit lifecycle from initial decompilation to APK repackaging and CVSS 4.0 reporting.
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
I’m using
Clone for Claude Code or OpenCode
Installs: Complete Android-Pentesting-Skill repository bundle · Claude Code, OpenCode
Before you start
APKTool 3.0.2+ with Java 17+
JADX 1.5.5+
Android SDK Platform Tools 36.0.2
Android SDK Build Tools 36.0.0
Frida 17.x, with the device's frida-server version matching the frida core version
Objection 1.12.5+
APKiD 3.1.0+
Run from: ~/.agents/skills/
In a terminal, change to the documented agent skills directory and clone the complete repository into the Android-Pentesting-Skill folder.
cd ~/.agents/skills/
git clone https://github.com/DragonJAR/Android-Pentesting-Skill Android-Pentesting-Skill
After cloning, open the Android-Pentesting-Skill repository root in a terminal and run the universal Python preflight check to verify all required tools.
Replace /path/to/app.apk with the local path to an APK you are authorized to assess.
Install and verify the documented toolchain prerequisites before starting.
Using Android-Pentesting-Skill, perform a basic security audit of the authorized APK at /path/to/app.apk. Start with the default static workflow, report only findings with traced context, and mark anything requiring runtime testing as "Needs Dynamic Confirmation."
Claude
OpenCode
Hermes