Skip to main content
affpapa.org
RU EN
skill CX Codex

dragonjar-android-pentesting-skill — Claude Code skill

Performs static and dynamic Android APK security checks, bypasses client protections with Frida, and scores findings against MASVS.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/security-skills --skill dragonjar-android-pentesting-skill -a claude-code
Open on GitHub

What dragonjar-android-pentesting-skill does

This skill guides AI agents through auditing Android packages. It decompiles binaries via jadx and apktool. Then it checks AndroidManifest settings against 50+ baseline rules and Semgrep MASTG checks. When inspecting React Native builds, it extracts index.android.bundle to spot leaked tokens.

Dynamic testing relies on 37 Frida scripts. The bundled runner detects 18 defense categories, covering RootBeer, emulator flags, and commercial RASP engines like DexGuard or Talsec. Reusable profiles let you test SSL pinning and root detection bypasses during a single run.

External binaries must be configured beforehand, specifically apktool, jadx, and frida-tools. Local Frida scripts cannot forge server-side verification like Play Integrity. You need an authorized test tenant on the backend to test those flows.

What it helps with

  • Discover hardcoded API secrets inside bytecode or React Native bundles
  • Bypass root detection and SSL certificate pinning using Frida scripts
  • Detect active RASP mechanisms and emulator checks in an APK
  • Calculate MASVS compliance scores with CVSS 4.0 vulnerability ratings

Example prompts for the agent

  • Audit this Android APK for security vulnerabilities using Semgrep
  • Detect RASP protections on com.example.app and run Frida bypass scripts
  • Generate a pentesting report with MASVS scoring for this APK

How to install dragonjar-android-pentesting-skill

1Skills CLI (Vercel)

npx skills add reason-machines/security-skills --skill dragonjar-android-pentesting-skill -a claude-code

2Manually: put the files in place

~/.claude/skills/dragonjar-android-pentesting-skill/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/dragonjar-android-pentesting-skill/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about dragonjar-android-pentesting-skill

How to install dragonjar-android-pentesting-skill in Claude Code?

Run npx skills add reason-machines/security-skills --skill dragonjar-android-pentesting-skill -a claude-code in your terminal.

What does dragonjar-android-pentesting-skill do?

It automates Android mobile penetration testing by decompiling APKs, finding static flaws, running dynamic Frida hooks, and scoring against OWASP MASVS.

Can this skill bypass backend Play Integrity attestation?

No. Client instrumentation scripts cannot forge server-side attestations such as SafetyNet or Play Integrity. Those checks require backend test tenants or lab allowlists.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set69

bitdefender-total-security-malware-analysis Teaches coding agents to spot fraudulent repositories peddling fake software cracks and study typical malware distribution tactics. CX Codex +1 969installs malware-detection-and-removal A skill for spotting repositories that pose as cracked software and deciding what to do about them. CX Codex +1 952installs bitdefender-total-security-awareness Instructs the AI to spot malware distribution repos disguised as antivirus cracks, stop dangerous execution, and recommend safe software. CX Codex +1 952installs npm-security-best-practices Guides npm dependency hardening, supply-chain attack prevention, and safer package-manager settings. Useful when reviewing Node.js installs. CX Codex +1 919installs malware-detection-security-awareness Helps AI agents spot malicious repositories disguised as cracked security software. Useful when verifying GitHub projects and avoiding malware delivery vectors. CX Codex +1 910installs malware-awareness-bitdefender-crack-fraud Detects fraudulent repositories that disguise info stealers and trojans as cracked Bitdefender utilities. It alerts developers before downloading untrusted binaries. CX Codex +1 872installs security-detections-mcp Connects your coding agent to an MCP server querying detection rules across Sigma, Splunk, and Elastic. Useful for spotting coverage gaps in MITRE ATT&CK. CX Codex +1 858installs malware-detection-and-reporting This skill flags repositories that disguise malware as legitimate security software and helps assemble evidence for a report. CX Codex +1 851installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor