[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFKZ2EMPSK1Z6FJQTN6Z61":3,"skill-same:01M6AFKZ2EMPSK1Z6FJQTN6Z61":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":77,"commitSha":78,"skillDirectory":79,"forksCount":80,"repositoryHtmlUrl":81,"repositoryHomepageUrl":82,"ownerHtmlUrl":83,"ownerBlogUrl":84,"ownerDescription":85,"updatedAt":86,"install":87,"resources":100},"01M6AFKZ2EMPSK1Z6FJQTN6Z61","performing-android-app-static-analysis-with-mobsf",null,"Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK\u002FAAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI\u002FCD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002FSKILL.md",[18,23,26,29],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"performing android app static analysis with mobsf","android","analysis","static analysis","permissions","mobsf","t1078","cryptography","owasp","static-analysis","APK","ci","code review","code","assessment","components","cybersecurity","security","review","testing","2026-11-10 10:12:30",false,"---\nname: performing-android-app-static-analysis-with-mobsf\ndescription: 'Performs automated static analysis of Android applications using Mobile\n  Security Framework (MobSF) to identify hardcoded secrets, insecure permissions,\n  vulnerable components, weak cryptography, and code-level security flaws without\n  executing the application. Use when assessing Android APK\u002FAAB files for security\n  vulnerabilities before deployment, during penetration testing, or as part of CI\u002FCD\n  security gates. Activates for requests involving Android static analysis, MobSF\n  scanning, APK security assessment, or mobile application code review.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- mobsf\n- static-analysis\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n---\n# Performing Android App Static Analysis with MobSF\n\n## When to Use\n\nUse this skill when:\n- Conducting security assessment of Android APK or AAB files before production release\n- Integrating automated mobile security scanning into CI\u002FCD pipelines\n- Performing initial triage of Android applications during penetration testing engagements\n- Reviewing third-party Android applications for supply chain security risks\n\n**Do not use** this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws.\n\n## Prerequisites\n\n- MobSF v4.x installed via Docker (`docker pull opensecurity\u002Fmobile-security-framework-mobsf`) or local setup\n- Target Android APK, AAB, or source code ZIP\n- Python 3.10+ for MobSF REST API integration\n- JADX decompiler (bundled with MobSF) for Java\u002FKotlin source recovery\n- Network access to MobSF web interface (default: http:\u002F\u002Flocalhost:8000)\n\n## Workflow\n\n### Step 1: Deploy MobSF and Obtain API Key\n\nLaunch MobSF using Docker for isolated, reproducible scanning:\n\n```bash\ndocker run -it --rm -p 8000:8000 opensecurity\u002Fmobile-security-framework-mobsf:latest\n```\n\nRetrieve the REST API key from the MobSF web interface at `http:\u002F\u002Flocalhost:8000\u002Fapi_docs` or from the startup console output. The API key enables programmatic scanning.\n\n### Step 2: Upload APK for Static Analysis\n\nUpload the target APK using the MobSF REST API:\n\n```bash\ncurl -F \"file=@target_app.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n```\n\nResponse includes the `hash` identifier used for subsequent API calls. MobSF automatically decompiles the APK using JADX, extracts the AndroidManifest.xml, and indexes all resources.\n\n### Step 3: Trigger and Retrieve Static Scan Results\n\nInitiate the static scan and retrieve results:\n\n```bash\n# Trigger scan\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fscan \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"scan_type=apk&file_name=target_app.apk&hash=\u003CFILE_HASH>\"\n\n# Retrieve JSON report\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Freport_json \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\"\n```\n\n### Step 4: Analyze Critical Findings\n\nMobSF static analysis covers these categories mapped to OWASP Mobile Top 10 2024:\n\n**Manifest Analysis (M8 - Security Misconfiguration)**:\n- Exported activities, services, receivers, and content providers without permission guards\n- `android:debuggable=\"true\"` left enabled\n- `android:allowBackup=\"true\"` enabling data extraction via ADB\n- Missing `android:networkSecurityConfig` for certificate pinning\n\n**Code Analysis (M1 - Improper Credential Usage)**:\n- Hardcoded API keys, passwords, and tokens in Java\u002FKotlin source\n- Insecure SharedPreferences usage for storing sensitive data\n- Weak or broken cryptographic implementations (ECB mode, static IV, hardcoded keys)\n\n**Network Security (M5 - Insecure Communication)**:\n- Missing certificate pinning configuration\n- Custom TrustManagers that accept all certificates\n- Cleartext HTTP traffic allowed without exception domains\n\n**Binary Analysis (M7 - Insufficient Binary Protections)**:\n- Missing ProGuard\u002FR8 obfuscation\n- Native library vulnerabilities (stack canaries, NX bit, PIE)\n- Debugger detection absence\n\n### Step 5: Generate and Export Reports\n\nExport findings in multiple formats for stakeholder communication:\n\n```bash\n# PDF report\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fdownload_pdf \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\" -o report.pdf\n\n# JSON for programmatic processing\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Freport_json \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\" -o report.json\n```\n\n### Step 6: Integrate into CI\u002FCD Pipeline\n\nAdd MobSF scanning as a build gate:\n\n```yaml\n# GitHub Actions example\n- name: MobSF Static Analysis\n  run: |\n    UPLOAD=$(curl -s -F \"file=@app\u002Fbuild\u002Foutputs\u002Fapk\u002Frelease\u002Fapp-release.apk\" \\\n      http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fupload -H \"Authorization: $MOBSF_API_KEY\")\n    HASH=$(echo $UPLOAD | jq -r '.hash')\n    curl -s -X POST http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fscan \\\n      -H \"Authorization: $MOBSF_API_KEY\" \\\n      -d \"scan_type=apk&file_name=app-release.apk&hash=$HASH\"\n    SCORE=$(curl -s -X POST http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fscorecard \\\n      -H \"Authorization: $MOBSF_API_KEY\" -d \"hash=$HASH\" | jq '.security_score')\n    if [ \"$SCORE\" -lt 60 ]; then exit 1; fi\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Static Analysis** | Examination of application code and resources without executing the program; catches structural and pattern-based vulnerabilities |\n| **APK Decompilation** | Process of recovering Java\u002FKotlin source from compiled Dalvik bytecode using tools like JADX or apktool |\n| **AndroidManifest.xml** | Configuration file declaring app components, permissions, and security attributes; primary target for manifest analysis |\n| **Certificate Pinning** | Technique binding an app to specific server certificates to prevent man-in-the-middle attacks via rogue CAs |\n| **ProGuard\u002FR8** | Code obfuscation and shrinking tools that make reverse engineering more difficult by renaming classes and removing unused code |\n\n## Tools & Systems\n\n- **MobSF**: Automated mobile security analysis framework supporting static and dynamic analysis of Android\u002FiOS apps\n- **JADX**: Dex-to-Java decompiler for recovering readable source code from Android APK files\n- **apktool**: Tool for reverse engineering Android APK files, decoding resources to near-original form\n- **Android Lint**: Google's static analysis tool for Android-specific code quality and security issues\n- **Semgrep**: Pattern-based static analysis engine with mobile-specific rule packs for custom vulnerability detection\n\n## Common Pitfalls\n\n- **Ignoring false positives**: MobSF flags patterns like `password` in variable names even when not storing actual credentials. Triage all HIGH findings manually before reporting.\n- **Missing obfuscated code**: Static analysis accuracy drops significantly against obfuscated apps. Supplement with dynamic analysis for apps using DexGuard or custom packers.\n- **Outdated MobSF rules**: Security rules evolve with Android API levels. Ensure MobSF is updated to match the target app's `targetSdkVersion`.\n- **Skipping native code analysis**: MobSF analyzes Java\u002FKotlin but has limited coverage of native C\u002FC++ libraries. Use `checksec` and manual review for `.so` files.\n","# Performing Android App Static Analysis with MobSF\n\n## When to Use\n\nUse this skill when:\n- Conducting security assessment of Android APK or AAB files before production release\n- Integrating automated mobile security scanning into CI\u002FCD pipelines\n- Performing initial triage of Android applications during penetration testing engagements\n- Reviewing third-party Android applications for supply chain security risks\n\n**Do not use** this skill as a replacement for manual code review or dynamic analysis -- MobSF static analysis catches pattern-based vulnerabilities but misses runtime logic flaws.\n\n## Prerequisites\n\n- MobSF v4.x installed via Docker (`docker pull opensecurity\u002Fmobile-security-framework-mobsf`) or local setup\n- Target Android APK, AAB, or source code ZIP\n- Python 3.10+ for MobSF REST API integration\n- JADX decompiler (bundled with MobSF) for Java\u002FKotlin source recovery\n- Network access to MobSF web interface (default: http:\u002F\u002Flocalhost:8000)\n\n## Workflow\n\n### Step 1: Deploy MobSF and Obtain API Key\n\nLaunch MobSF using Docker for isolated, reproducible scanning:\n\n```bash\ndocker run -it --rm -p 8000:8000 opensecurity\u002Fmobile-security-framework-mobsf:latest\n```\n\nRetrieve the REST API key from the MobSF web interface at `http:\u002F\u002Flocalhost:8000\u002Fapi_docs` or from the startup console output. The API key enables programmatic scanning.\n\n### Step 2: Upload APK for Static Analysis\n\nUpload the target APK using the MobSF REST API:\n\n```bash\ncurl -F \"file=@target_app.apk\" http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fupload \\\n  -H \"Authorization: \u003CAPI_KEY>\"\n```\n\nResponse includes the `hash` identifier used for subsequent API calls. MobSF automatically decompiles the APK using JADX, extracts the AndroidManifest.xml, and indexes all resources.\n\n### Step 3: Trigger and Retrieve Static Scan Results\n\nInitiate the static scan and retrieve results:\n\n```bash\n# Trigger scan\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fscan \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"scan_type=apk&file_name=target_app.apk&hash=\u003CFILE_HASH>\"\n\n# Retrieve JSON report\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Freport_json \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\"\n```\n\n### Step 4: Analyze Critical Findings\n\nMobSF static analysis covers these categories mapped to OWASP Mobile Top 10 2024:\n\n**Manifest Analysis (M8 - Security Misconfiguration)**:\n- Exported activities, services, receivers, and content providers without permission guards\n- `android:debuggable=\"true\"` left enabled\n- `android:allowBackup=\"true\"` enabling data extraction via ADB\n- Missing `android:networkSecurityConfig` for certificate pinning\n\n**Code Analysis (M1 - Improper Credential Usage)**:\n- Hardcoded API keys, passwords, and tokens in Java\u002FKotlin source\n- Insecure SharedPreferences usage for storing sensitive data\n- Weak or broken cryptographic implementations (ECB mode, static IV, hardcoded keys)\n\n**Network Security (M5 - Insecure Communication)**:\n- Missing certificate pinning configuration\n- Custom TrustManagers that accept all certificates\n- Cleartext HTTP traffic allowed without exception domains\n\n**Binary Analysis (M7 - Insufficient Binary Protections)**:\n- Missing ProGuard\u002FR8 obfuscation\n- Native library vulnerabilities (stack canaries, NX bit, PIE)\n- Debugger detection absence\n\n### Step 5: Generate and Export Reports\n\nExport findings in multiple formats for stakeholder communication:\n\n```bash\n# PDF report\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Fdownload_pdf \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\" -o report.pdf\n\n# JSON for programmatic processing\ncurl -X POST http:\u002F\u002Flocalhost:8000\u002Fapi\u002Fv1\u002Freport_json \\\n  -H \"Authorization: \u003CAPI_KEY>\" \\\n  -d \"hash=\u003CFILE_HASH>\" -o report.json\n```\n\n### Step 6: Integrate into CI\u002FCD Pipeline\n\nAdd MobSF scanning as a build gate:\n\n```yaml\n# GitHub Actions example\n- name: MobSF Static Analysis\n  run: |\n    UPLOAD=$(curl -s -F \"file=@app\u002Fbuild\u002Foutputs\u002Fapk\u002Frelease\u002Fapp-release.apk\" \\\n      http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fupload -H \"Authorization: $MOBSF_API_KEY\")\n    HASH=$(echo $UPLOAD | jq -r '.hash')\n    curl -s -X POST http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fscan \\\n      -H \"Authorization: $MOBSF_API_KEY\" \\\n      -d \"scan_type=apk&file_name=app-release.apk&hash=$HASH\"\n    SCORE=$(curl -s -X POST http:\u002F\u002Fmobsf:8000\u002Fapi\u002Fv1\u002Fscorecard \\\n      -H \"Authorization: $MOBSF_API_KEY\" -d \"hash=$HASH\" | jq '.security_score')\n    if [ \"$SCORE\" -lt 60 ]; then exit 1; fi\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Static Analysis** | Examination of application code and resources without executing the program; catches structural and pattern-based vulnerabilities |\n| **APK Decompilation** | Process of recovering Java\u002FKotlin source from compiled Dalvik bytecode using tools like JADX or apktool |\n| **AndroidManifest.xml** | Configuration file declaring app components, permissions, and security attributes; primary target for manifest analysis |\n| **Certificate Pinning** | Technique binding an app to specific server certificates to prevent man-in-the-middle attacks via rogue CAs |\n| **ProGuard\u002FR8** | Code obfuscation and shrinking tools that make reverse engineering more difficult by renaming classes and removing unused code |\n\n## Tools & Systems\n\n- **MobSF**: Automated mobile security analysis framework supporting static and dynamic analysis of Android\u002FiOS apps\n- **JADX**: Dex-to-Java decompiler for recovering readable source code from Android APK files\n- **apktool**: Tool for reverse engineering Android APK files, decoding resources to near-original form\n- **Android Lint**: Google's static analysis tool for Android-specific code quality and security issues\n- **Semgrep**: Pattern-based static analysis engine with mobile-specific rule packs for custom vulnerability detection\n\n## Common Pitfalls\n\n- **Ignoring false positives**: MobSF flags patterns like `password` in variable names even when not storing actual credentials. Triage all HIGH findings manually before reporting.\n- **Missing obfuscated code**: Static analysis accuracy drops significantly against obfuscated apps. Supplement with dynamic analysis for apps using DexGuard or custom packers.\n- **Outdated MobSF rules**: Security rules evolve with Android API levels. Ensure MobSF is updated to match the target app's `targetSdkVersion`.\n- **Skipping native code analysis**: MobSF analyzes Java\u002FKotlin but has limited coverage of native C\u002FC++ libraries. Use `checksec` and manual review for `.so` files.\n",{"name":5,"tags":60,"author":64,"domain":51,"license":15,"version":65,"nist_csf":66,"subdomain":61,"description":71,"mitre_attack":72},[61,36,40,44,62,63],"mobile-security","owasp-mobile","penetration-testing","mahipal","1.0.0",[67,68,69,70],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK\u002FAAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI\u002FCD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.\n",[73,74,75,76],"T1059","T1056","T1036","T1078","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-android-app-static-analysis-with-mobsf",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":88,"prompt":98,"zipAvailable":99},[89,92,95],{"tool":90,"command":91},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf",{"tool":93,"command":94},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf",{"tool":96,"command":97},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-android-app-static-analysis-with-mobsf","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002FSKILL.md",true,[101,107,112,118,122,126,132],{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"assets\u002Ftemplate.md","ASSET","资产文件",3704,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Fassets\u002Ftemplate.md",{"path":108,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002FLICENSE",{"path":113,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fapi-reference.md","REFERENCE","参考文档",5628,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Freferences\u002Fapi-reference.md",{"path":119,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":120,"sourceHtmlUrl":121},"references\u002Fstandards.md",2929,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Freferences\u002Fstandards.md",{"path":123,"resourceType":114,"resourceTypeDesc":115,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fworkflows.md",3822,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Freferences\u002Fworkflows.md",{"path":127,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fagent.py","SCRIPT","脚本",9228,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Fscripts\u002Fagent.py",{"path":133,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fprocess.py",8283,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-android-app-static-analysis-with-mobsf\u002Fscripts\u002Fprocess.py",[137,161,185,209,235,262],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[143],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[145,146,147,148,52,51,149,150,151,48,152,46,153,154,155,156,157,158,159,160],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","artifacts","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[167],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[169,157,170,171,52,172,51,151,173,174,175,176,177,178,179,180,181,182,183,184],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":193,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[191,192],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[179,194,195,196,54,51,197,198,173,199,200,201,202,203,204,41,205,206,207,208],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[215],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,51,220,221,222,223,224,225,226,227,228,229,230,231,176,232,233,234],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[241],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[243,244,245,51,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":269,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[268],{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},[52,270,51,271,272,273,274,275,276,277,278,41,279,205,37,280,281,282,283,284],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]