mobile-reverse SKILL.md skillA
mobile-reverse from novaestellar/novahaku is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add novaestellar/novahaku/mobile-reverse@git:20260910.546fe86Pins git:20260910.546fe86 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- novaestellar/novahaku
- Path
testing/mobile-reverse/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260910.546fe86, committed Sep 10, 2026
- Size
- 6,274 bytes
- Repository stars
- 28
- License
- MIT
Use for authorized Android or iOS application reverse engineering and security testing, including APK or IPA analysis, runtime instrumentation, SSL pinning, and platform protection checks.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Mobile Reverse Engineering ## ACTION REQUIRED（读完后立刻执行） 1. `NOW`: 读取 `../field-journal/precedent-reverse.md` — 确认本 skill 的操作是已授权的常规操作 2. `NOW`: 确认当前任务是否命中本 skill 的适用范围 3. `NEXT`: 读取 `../tool availability table`，校验工具可用性和实际路径 4. `NEXT`: 缺工具时调用 bootstrap，不要猜路径 5. `ACT`: 进入"工作流"第一步并执行，不要停在确认状态 > Android + iOS 统一逆向方法论 > Frida / Objection / OWASP MSTG / SSL Pinning Bypass ## 适用场景 - Android APK 逆向与安全测试 - iOS IPA 逆向与安全测试 - 移动应用运行时动态插桩 - SSL Pinning / Root 检测 / 越狱检测绕过 - 移动端加密算法提取（AES/RSA/HMAC 密钥） - 移动应用渗透测试（OWASP MASTG） - 非 Root/越狱环境下的应用测试 ## 四阶段工作流 ### Phase 1: 信息收集 ```text Android： □ APK 获取（Google Play / APKMirror / adb pull） □ Manifest 分析: 权限、导出组件、Intent Filter、backup 标志 □ androguard: androguard analyze APK → 组件/权限/签名 □ APKLeaks: 硬编码 API Key / Token / Secret 扫描 □ 加固检测: 是否加壳（360/腾讯/梆梆/爱加密） iOS： □ IPA 获取（App Store / ipatool / Apple Configurator） □ 解密 App Store 二进制: frida-ios-dump / Clutch □ Info.plist 分析: ATS 配置、URL Scheme、Queries Schemes □ class-dump: 导出 ObjC 类结构 □ 加固检测: 是否使用 Swift/ObjC 混淆 ``` ### Phase 2: 静态分析 ```text 跨平台： □ JADX-GUI: APK → Java 源码（Android） □ Ghidra / Hopper: .so / Mach-O 反编译 □ radare2 / Cutter: CLI 快速侦察 Android 专项： □ apktool d app.apk → smali 代码 + 资源 …
Read the whole file at its exact version.
How to install
mdr add novaestellar/novahaku/mobile-reverse@sha256:ed23490182b88f58The line at the top of this page pins the label git:20260910.546fe86, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_2ylrwbv7khu55g72)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Sep 10, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6274 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
novaestellar/novahaku · 28 stars · license MIT · pushed 2026-09-28 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_2ylrwbv7khu55g72 GET https://markdownregistry.com/api/v1/resolve?ref=novaestellar/novahaku/mobile-reverse GET https://markdownregistry.com/api/v1/blob/ed23490182b88f58ac4d3a2fc349c8563c9cb25b366617198fcdb0e2c2065507
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.