# Mobile Security

> Mobile application security testing — Android (smali, Frida, IL2CPP, Flutter AOT, root detection), iOS (jailbreak, Objection).

- **Type:** Skill
- **Install:** `agentstack add skill-transilienceai-communitytools-mobile-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [transilienceai](https://agentstack.voostack.com/s/transilienceai)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [transilienceai](https://github.com/transilienceai)
- **Source:** https://github.com/transilienceai/communitytools/tree/main/skills/mobile-security
- **Website:** https://www.transilience.ai/

## Install

```sh
agentstack add skill-transilienceai-communitytools-mobile-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Mobile Security

## Scope

Security testing of mobile applications, with emphasis on static analysis of compiled artifacts (Dart AOT snapshots, Unity IL2CPP, native ARM64 libraries, smali bytecode) before reaching for dynamic instrumentation. Covers the toolchain selection puzzle (blutter / doldrums / reFlutter for Flutter; Il2CppDumper for Unity; jadx + apktool for stock Android), envelope reverse-engineering for crypto-wrapped APIs (RSA-OAEP key wrapping, AES-CBC body encryption, base64 header transport), TLS pinning bypass, and root/jailbreak detection bypass. Static dump first; dynamic Frida/Objection only when static is insufficient.

## When to use

- Mobile target ships an Android APK (or iOS IPA) — extract and inspect before any runtime testing.
- App is built with **Flutter** (`lib/arm64-v8a/libapp.so` present) — needs Dart-aware decompiler.
- App is built with **Unity** (`libil2cpp.so` + `global-metadata.dat`) — needs Il2CppDumper.
- App uses encrypted API envelopes (KEY/IV/SALT/SIGNATURE headers, base64 body) and you need to reverse the crypto contract.
- You suspect IDOR, mass assignment, or business-logic flaws that are easier to find in the dumped client code than via black-box API testing.
- TLS pinning or root detection blocks dynamic testing — static analysis is the path forward.

## References

- [reference/flutter-aot-reversing.md](reference/flutter-aot-reversing.md) — Flutter AOT (Dart) static analysis with blutter; common HTTP envelope patterns (fast_rsa OAEP-SHA256 + AES-256-CBC); banking-app exploitation patterns.
- [reference/scenarios/android/native-lib-host-extraction.md](reference/scenarios/android/native-lib-host-extraction.md) — host-side `dlopen` of an Android `.so` with a Bionic→glibc forwarder + `strcmp`/`memcmp` interceptor to dump expected values without Frida or an emulator.
- [../reverse-engineering/reference/scenarios/obfuscation/hash-dispatcher-chain.md](../reverse-engineering/reference/scenarios/obfuscation/hash-dispatcher-chain.md) — when an Android `.so` validates input via hundreds of polynomial-hash dispatcher functions and constructs the secret deterministically from input bytes (HTB WonderSMS pattern); use Z3 over the chain rather than emulating.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [transilienceai](https://github.com/transilienceai)
- **Source:** [transilienceai/communitytools](https://github.com/transilienceai/communitytools)
- **License:** MIT
- **Homepage:** https://www.transilience.ai/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-transilienceai-communitytools-mobile-security
- Seller: https://agentstack.voostack.com/s/transilienceai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.