The Agent Skills Directory

[COMMAND_EXECUTION]: The skill contains numerous shell command examples for mobile security tools such as jadx, apktool, aapt2, frida, objection, adb, and xmlstarlet. These are standard command-line utilities for security auditing and reverse engineering.
[DATA_EXFILTRATION]: Instructions include searching for sensitive information like API keys, tokens, and credentials within mobile application packages (.apk, .ipa) and local storage. This data collection is the intended primary purpose of the skill (security assessment) and does not involve exfiltration to external third-party domains.
[DYNAMIC_EXECUTION]: The skill references the use of Frida for runtime instrumentation and SSL pinning bypass. It provides examples of loading JavaScript hooks to modify application behavior during testing, which is a standard technique in mobile security research.
[INDIRECT_PROMPT_INJECTION]: The skill mentions processing untrusted data from mobile application packages and traffic interception. It includes boundary markers and capability inventories (e.g., manifest analysis, storage inspection) to guide the agent in handling this data securely within a pentesting context.
[SAFE]: References to external repositories like httptoolkit/frida-interception-and-unpinning and WithSecureLabs/drozer are to well-known, community-standard security tools. No suspicious remote code execution or obfuscation was detected.

mobile-technique