ctf-mobile

Mobile CTF workflow.

IndexedMIT

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/onesword-ai-ctf-mobile

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Mobile CTF workflow. Use for Android APK/AAB, iOS IPA, mobile app source, native libraries, hardcoded secrets, storage issues, exported components, Frida-style dynamic analysis planning, and mobile network traffic.

Use cases: security, productivity

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/ctf-mobile

What's inside

Skill name: ctf-mobile
Description: Mobile CTF workflow. Use for Android APK/AAB, iOS IPA, mobile app source, native libraries, hardcoded secrets, storage issues, exported components, Frida-style dynamic analysis planning, and mobile network traffic.
License: MIT
Instructions: 19 lines in SKILL.md · view on GitHub

Files (2)

SKILL.md
openai.yaml · agents/

SKILL.md (first lines)

# CTF Mobile

## Workflow

1. Identify platform, package metadata, permissions, exported components, native libraries, and bundled assets.
2. Extract low-cost evidence: manifest, strings, resources, certificates, config files, and obvious endpoints.
3. Decompile or inspect code paths for flag construction, crypto misuse, API keys, debug logic, and root/emulator checks.
4. Plan dynamic hooks only after static evidence identifies a target function or storage location.
5. Check local files and network traces for recovered tokens or flags.

## Evidence Rules

Record artifact path, package identifier, class/function, resource key, endpoint, and command output. Do not confirm a secret as a flag without matching format or challenge response.

## Output

Return app metadata, suspicious code/resources, candidate flags, tool outputs, and next actions such as "hook validation method" or "inspect native library".

From OneSword-AI/CyberAgent, MIT.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit (this folder): Aug 18, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/OneSword-AI/CyberAgent
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from OneSword-AI

Cite this page

ctf-mobile skill. Agent Mart. https://agentmart.dev/skills/onesword-ai-ctf-mobile (last updated 2026-10-24)