mobile-android

Android APK pentest workflow — apktool/jadx static, Frida dynamic instrumentation, SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/mobile/android/SKILL.md

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The playbook is highly actionable and token-efficient, with concrete commands and an executable Frida example across clearly numbered phases. It loses points on workflow clarity (no explicit validation checkpoints for destructive PoC steps) and progressive disclosure (everything inlined rather than split into reference files).

Suggestions

Add explicit validation checkpoints between phases (e.g., 'Confirm frida-ps -U lists the target process before hooking', 'Verify base.apk decompiled fully before grepping') to lift workflow clarity above 3.

Move the tools cheat-sheet, severity table, and known-exemplars into a references/ file (e.g. REFERENCES.md) and link from SKILL.md so the top-level file becomes a leaner overview, improving progressive disclosure.

Resolve the version placeholder in the frida-server push command ('frida-server-16.x.x-android-arm64') with a note on how to fetch the matching server version, removing the last minor actionability gap.

Dimension	Reasoning	Score
Conciseness	The body is lean — code blocks with terse inline comments and minimal prose, assuming Claude knows the domain — with only a few trimmable asides ('# Combine for full picture', '# Or jadx-gui for interactive').	4 / 5
Actionability	It provides copy-paste-ready commands (adb, apktool, jadx, frida, objection, apkanalyzer) and a fully executable Frida JS hook snippet, covering the common static/dynamic/extraction cases.	5 / 5
Workflow Clarity	Phases are clearly numbered (Static → Dynamic → Attack surface → PoC → Severity → Defender) but there are no explicit validation/verification checkpoints, and destructive PoC operations (e.g. 'rm -rf' RCE, adb backup unpack) lack verify-before-proceeding loops.	3 / 5
Progressive Disclosure	Section structure is clear and well-headed, but the ~210-line body is entirely inline with no reference files; content that could be split out (tools cheat-sheet, severity table, defender checklist, exemplars) is all inlined in SKILL.md.	3 / 5
	Total	15 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and action-rich, clearly scoped to Android APK pentesting with strong tool-name triggers. Its main weakness is the absence of an explicit 'Use when...' trigger clause in the description field, which caps completeness at 3.

Suggestions

Append an explicit 'Use when...' clause to the description (e.g., 'Use when pentesting Android APKs, bypassing SSL pinning/root detection, or fuzzing intents') so the trigger is self-contained rather than only in metadata.when_to_use.

Add a few natural synonyms/file extensions a user might say ('.apk', 'reverse engineering', 'MobSF') to broaden trigger-term coverage from 4 toward 5.

Keep the third-person voice (already correct) but consider tightening the em-dash list into a single clause to avoid the description reading as a tag list rather than a sentence.

Dimension	Reasoning	Score
Specificity	The description lists six concrete actions ('apktool/jadx static, Frida dynamic instrumentation, SSL pinning bypass, root detection bypass, intent fuzzing, keystore extraction'), giving comprehensive coverage of the workflow.	5 / 5
Completeness	It clearly answers 'what' (Android APK pentest workflow with named actions) but lacks any 'Use when...' clause in the description field — trigger guidance lives only in metadata.when_to_use — so completeness is capped at 3 per the rubric.	3 / 5
Trigger Term Quality	It includes strong natural domain keywords ('Android APK pentest', 'Frida', 'SSL pinning', 'keystore') a user would say, but omits common synonyms/extensions like '.apk', 'reverse engineering', or 'MobSF'.	4 / 5
Distinctiveness Conflict Risk	'Android APK pentest' with specific tool triggers (apktool, Frida, SSL pinning, keystore) carves a clear niche, with only minor overlap risk against a closely related general android-re skill.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/mobile/android/SKILL.md
Commit: 31e1c8e

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.