Agent skill · security · aradotso
dragonjar-android-pentesting-skill
Comprehensive Android APK security analysis with static/dynamic testing, RASP detection, Frida instrumentation, and MASVS compliance scoring
Why this skill is useful
Adds executable scripts for comprehensive APK security analysis, including bypassing protections and generating compliance reports that the AI cannot generate on its own.
What it needs
Requires android-platform-tools, apkid, apktool, frida-tools, jadx, objection, semgrep installed locally. About 10k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
DragonJAR Android Pentesting Skill Skill by ara.so — Security Skills collection. This skill provides comprehensive Android APK security analysis capabilities for AI agents, combining static analysis, dynamic instrumentation with Frida, RASP detection, authorized bypass validation, source-to-sink tracing, MASVS scoring, and professional reporting in a unified workflow. What This Skill Does Transforms an AI agent into an expert Android security auditor capable of: APK Analysis: Decode APKs with APKTool, decompile with JADX, detect frameworks with APKiD Static Security Analysis: 50+ manifest checks, 70+ Semgrep MASTG rules, secret detection, obfuscation analysis Dynamic Instrumentation: 37 Frida scripts for SSL pinning bypass, root detection bypass, crypto interception Runtime Defense Analysis (RDA): Detect 18 protection categories (RootBeer, SafetyNet, Frida detection, RASP, etc.) RASP Bypass: Authorized bypass runner with reusable profiles, DRY workflow Data Flow Tracing: Source-to-sink methodology with confidence levels MASVS Compliance: Automated scoring against OWASP MASVS controls with CVSS 4.0 APK Modification: Smali patching, repackaging, signing, validation Installation Prerequisites Install required tools (Linux/macOS): Skill Installation Verification Core Workflows 1. Basic APK Security Audit Example findings output: 2. Runtime Defense Analysis (RASP Detection) RDA output structure: 3. RASP Bypass Workflow (DRY Pattern) Important: Client-side bypasses do NOT forge server-side attestation. For Play Integrity, SafetyNet, Approov, or similar backend-enforced controls, use an authorized test tenant, backend allowlist, or approved lab configuration. 4. SSL Pinning Bypass 5. Framework-Specific Analysis React Native Hook React Native bridge: Flutter 6. Data Flow Tracing Flow confidence levels: CONFIRMED: Direct observable flow without conditions LIKELY: Flow with minimal conditional branches POSSIBLE: Flow through complex logic, needs dynamic validation 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/dragonjar-android-pentesting-skill