From asi
Performs automated static analysis of Android APK/AAB files using MobSF to detect hardcoded secrets, insecure permissions, vulnerable components, and weak cryptography. For pre-deployment scans, pentesting, or CI/CD security gates.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Use this skill when:
Performs static analysis of Android APK/AAB files with MobSF to detect hardcoded secrets, insecure permissions, vulnerable components, and crypto flaws. For pentesting, CI/CD gates, and APK reviews.
Performs automated static analysis on Android APK/AAB files using MobSF to identify hard-coded secrets, insecure permissions, vulnerable components, weak encryption, and code defects. For pre-deployment security audits, pentesting, or CI/CD gates.
Hunts vulnerabilities in Android APKs using DECX CLI and JADX: enumerates attack surfaces, triages exported components and deep links, traces WebView/IPC flows, screens exploitability, generates bilingual reports with PoC handoff.
Share bugs, ideas, or general feedback.
Use this skill when:
Do not use this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws.
docker pull opensecurity/mobile-security-framework-mobsf) or local setupLaunch MobSF using Docker for isolated, reproducible scanning:
docker run -it --rm -p 8000:8000 opensecurity/mobile-security-framework-mobsf:latest
Retrieve the REST API key from the MobSF web interface at http://localhost:8000/api_docs or from the startup console output. The API key enables programmatic scanning.
Upload the target APK using the MobSF REST API:
curl -F "file=@target_app.apk" http://localhost:8000/api/v1/upload \
-H "Authorization: <API_KEY>"
Response includes the hash identifier used for subsequent API calls. MobSF automatically decompiles the APK using JADX, extracts the AndroidManifest.xml, and indexes all resources.
Initiate the static scan and retrieve results:
# Trigger scan
curl -X POST http://localhost:8000/api/v1/scan \
-H "Authorization: <API_KEY>" \
-d "scan_type=apk&file_name=target_app.apk&hash=<FILE_HASH>"
# Retrieve JSON report
curl -X POST http://localhost:8000/api/v1/report_json \
-H "Authorization: <API_KEY>" \
-d "hash=<FILE_HASH>"
MobSF static analysis covers these categories mapped to OWASP Mobile Top 10 2024:
Manifest Analysis (M8 - Security Misconfiguration):
android:debuggable="true" left enabledandroid:allowBackup="true" enabling data extraction via ADBandroid:networkSecurityConfig for certificate pinningCode Analysis (M1 - Improper Credential Usage):
Network Security (M5 - Insecure Communication):
Binary Analysis (M7 - Insufficient Binary Protections):
Export findings in multiple formats for stakeholder communication:
# PDF report
curl -X POST http://localhost:8000/api/v1/download_pdf \
-H "Authorization: <API_KEY>" \
-d "hash=<FILE_HASH>" -o report.pdf
# JSON for programmatic processing
curl -X POST http://localhost:8000/api/v1/report_json \
-H "Authorization: <API_KEY>" \
-d "hash=<FILE_HASH>" -o report.json
Add MobSF scanning as a build gate:
# GitHub Actions example
- name: MobSF Static Analysis
run: |
UPLOAD=$(curl -s -F "file=@app/build/outputs/apk/release/app-release.apk" \
http://mobsf:8000/api/v1/upload -H "Authorization: $MOBSF_API_KEY")
HASH=$(echo $UPLOAD | jq -r '.hash')
curl -s -X POST http://mobsf:8000/api/v1/scan \
-H "Authorization: $MOBSF_API_KEY" \
-d "scan_type=apk&file_name=app-release.apk&hash=$HASH"
SCORE=$(curl -s -X POST http://mobsf:8000/api/v1/scorecard \
-H "Authorization: $MOBSF_API_KEY" -d "hash=$HASH" | jq '.security_score')
if [ "$SCORE" -lt 60 ]; then exit 1; fi
| Term | Definition |
|---|---|
| Static Analysis | Examination of application code and resources without executing the program; catches structural and pattern-based vulnerabilities |
| APK Decompilation | Process of recovering Java/Kotlin source from compiled Dalvik bytecode using tools like JADX or apktool |
| AndroidManifest.xml | Configuration file declaring app components, permissions, and security attributes; primary target for manifest analysis |
| Certificate Pinning | Technique binding an app to specific server certificates to prevent man-in-the-middle attacks via rogue CAs |
| ProGuard/R8 | Code obfuscation and shrinking tools that make reverse engineering more difficult by renaming classes and removing unused code |
password in variable names even when not storing actual credentials. Triage all HIGH findings manually before reporting.targetSdkVersion.checksec and manual review for .so files.