performing-mobile-app-certificate-pinning-bypass

SUSPICIOUS: the skill is internally coherent and uses mostly legitimate tool sources, but it grants an AI agent offensive security capabilities to defeat certificate pinning and intercept app traffic. This is not confirmed malware or covert credential theft, yet it is a high-risk security skill that should only be used in tightly authorized assessment contexts.

The visible code is a security-testing/mobile reverse-engineering tool rather than an apparent package-infection payload. Its Frida and Objection commands intentionally weaken TLS certificate validation and therefore present dual-use security risk when run against unauthorized applications. No exfiltration or persistence behavior is shown. Execution is currently prevented by syntax errors and the absent Frida script content. Review the missing script before use and restrict operation to authorized test devices and applications.

The fragment documents a dual-use mobile security testing tool for detecting and bypassing certificate pinning. The bypass behavior is inherently security-sensitive, but the supplied material contains no executable implementation or evidence of malware, data theft, obfuscation, or unauthorized persistence. Review the actual subprocess and instrumentation code before deployment and restrict use to authorized applications and devices.