[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFRRH5DV2YCFDE0DCX00QM":3,"skill-same:01M6AFRRH5DV2YCFDE0DCX00QM":127},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AFRRH5DV2YCFDE0DCX00QM","performing-dynamic-analysis-of-android-app",null,"Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"android","performing dynamic analysis of android app","analysis","dynamic-analysis","testing","security","applications","t1059","execution","t1078","owasp","analyzing","static analysis","owasp-mobile","frida","objection","mobile-security","pr","debug","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-dynamic-analysis-of-android-app\ndescription: 'Performs runtime dynamic analysis of Android applications using Frida,\n  Objection, and Android Debug Bridge to observe application behavior during execution,\n  intercept function calls, modify runtime values, and identify vulnerabilities that\n  static analysis misses. Use when testing Android apps for runtime security flaws,\n  hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated\n  applications. Activates for requests involving Android dynamic analysis, runtime\n  hooking, Frida Android instrumentation, or live app behavior analysis.\n\n  '\ndomain: cybersecurity\nsubdomain: mobile-security\nauthor: mahipal\ntags:\n- mobile-security\n- android\n- frida\n- dynamic-analysis\n- owasp-mobile\n- penetration-testing\nversion: 1.0.0\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.AA-05\n- ID.RA-01\n- DE.CM-09\nmitre_attack:\n- T1059\n- T1056\n- T1036\n- T1078\n- T1027\n---\n# Performing Dynamic Analysis of Android App\n\n## When to Use\n\nUse this skill when:\n- Static analysis results need runtime validation on an actual Android device\n- The target app uses obfuscation (DexGuard, custom packers) that prevents effective static analysis\n- Testing requires observing actual API calls, decrypted data, or runtime-generated values\n- Assessing root detection, tamper detection, or anti-debugging implementations\n\n**Do not use** this skill on production environments without authorization -- dynamic instrumentation can alter app behavior and trigger security alerts.\n\n## Prerequisites\n\n- Rooted Android device or emulator (Genymotion, Android Studio AVD with writable system)\n- Frida server installed on device matching the architecture (arm64, x86_64)\n- Python 3.10+ with `frida-tools` and `objection` packages\n- ADB configured and device connected\n- Target APK installed on device\n\n## Workflow\n\n### Step 1: Setup Frida Server on Android Device\n\n```bash\n# Check device architecture\nadb shell getprop ro.product.cpu.abi\n# Output: arm64-v8a\n\n# Download matching Frida server from GitHub releases\n# https:\u002F\u002Fgithub.com\u002Ffrida\u002Ffrida\u002Freleases\n# Push to device\nadb push frida-server-16.x.x-android-arm64 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server\nadb shell chmod 755 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server\nadb shell \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server &\n\n# Verify Frida connection\nfrida-ps -U\n```\n\n### Step 2: Enumerate Application Attack Surface\n\n```bash\n# List all packages\nfrida-ps -U -a\n\n# Attach Objection for high-level exploration\nobjection --gadget com.target.app explore\n\n# List activities, services, receivers\nandroid hooking list activities\nandroid hooking list services\nandroid hooking list receivers\n\n# List loaded classes\nandroid hooking list classes\nandroid hooking search classes com.target.app\n```\n\n### Step 3: Hook Sensitive Methods\n\n```bash\n# Hook all methods of a class\nandroid hooking watch class com.target.app.auth.LoginManager\n\n# Hook specific method with argument dumping\nandroid hooking watch class_method com.target.app.auth.LoginManager.authenticate --dump-args --dump-return\n\n# Hook crypto operations\nandroid hooking watch class javax.crypto.Cipher --dump-args\nandroid hooking watch class java.security.MessageDigest --dump-args\n\n# Hook network calls\nandroid hooking watch class okhttp3.OkHttpClient --dump-args\nandroid hooking watch class java.net.URL --dump-args\n```\n\n### Step 4: Write Custom Frida Scripts for Deep Analysis\n\n```javascript\n\u002F\u002F hook_crypto.js - Intercept encryption\u002Fdecryption operations\nJava.perform(function() {\n    var Cipher = Java.use(\"javax.crypto.Cipher\");\n\n    Cipher.doFinal.overload(\"[B\").implementation = function(input) {\n        var mode = this.getAlgorithm();\n        console.log(\"[Cipher] Algorithm: \" + mode);\n        console.log(\"[Cipher] Input: \" + bytesToHex(input));\n\n        var result = this.doFinal(input);\n        console.log(\"[Cipher] Output: \" + bytesToHex(result));\n        return result;\n    };\n\n    function bytesToHex(bytes) {\n        var hex = [];\n        for (var i = 0; i \u003C bytes.length; i++) {\n            hex.push((\"0\" + (bytes[i] & 0xFF).toString(16)).slice(-2));\n        }\n        return hex.join(\"\");\n    }\n});\n```\n\n```bash\n# Execute custom Frida script\nfrida -U -f com.target.app -l hook_crypto.js --no-pause\n```\n\n### Step 5: Bypass Root Detection\n\n```javascript\n\u002F\u002F root_bypass.js - Common root detection bypass\nJava.perform(function() {\n    \u002F\u002F Bypass RootBeer library\n    var RootBeer = Java.use(\"com.scottyab.rootbeer.RootBeer\");\n    RootBeer.isRooted.implementation = function() {\n        console.log(\"[RootBeer] isRooted() bypassed\");\n        return false;\n    };\n\n    \u002F\u002F Bypass generic file-based root checks\n    var File = Java.use(\"java.io.File\");\n    var originalExists = File.exists;\n    File.exists.implementation = function() {\n        var path = this.getAbsolutePath();\n        var rootPaths = [\"\u002Fsystem\u002Fapp\u002FSuperuser.apk\", \"\u002Fsystem\u002Fxbin\u002Fsu\",\n                         \"\u002Fsbin\u002Fsu\", \"\u002Fsystem\u002Fbin\u002Fsu\", \"\u002Fdata\u002Flocal\u002Fbin\u002Fsu\"];\n        if (rootPaths.indexOf(path) >= 0) {\n            console.log(\"[Root] Blocked check for: \" + path);\n            return false;\n        }\n        return originalExists.call(this);\n    };\n\n    \u002F\u002F Bypass SafetyNet\u002FPlay Integrity\n    try {\n        var SafetyNet = Java.use(\"com.google.android.gms.safetynet.SafetyNetApi\");\n        console.log(\"[SafetyNet] Class found - may need additional bypass\");\n    } catch(e) {}\n});\n```\n\n### Step 6: Analyze Network Communication at Runtime\n\n```javascript\n\u002F\u002F network_monitor.js - Monitor all HTTP requests\nJava.perform(function() {\n    \u002F\u002F Hook OkHttp3\n    try {\n        var OkHttpClient = Java.use(\"okhttp3.OkHttpClient\");\n        var Interceptor = Java.use(\"okhttp3.Interceptor\");\n        var Chain = Java.use(\"okhttp3.Interceptor$Chain\");\n\n        console.log(\"[OkHttp] Monitoring network requests...\");\n\n        var Request = Java.use(\"okhttp3.Request\");\n        Request.url.implementation = function() {\n            var url = this.url();\n            console.log(\"[OkHttp] URL: \" + url.toString());\n            return url;\n        };\n    } catch(e) {\n        console.log(\"[OkHttp] Not found, trying HttpURLConnection\");\n    }\n\n    \u002F\u002F Hook HttpURLConnection\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[URL] Opening: \" + this.toString());\n        return this.openConnection();\n    };\n});\n```\n\n### Step 7: Extract Decrypted Data and Secrets\n\n```bash\n# Using Objection for quick extraction\nobjection --gadget com.target.app explore\n\n# Dump Android Keystore entries\nandroid keystore list\nandroid keystore dump\n\n# Search heap for sensitive objects\nandroid heap search instances com.target.app.model.User\nandroid heap evaluate \u003Chandle> \"JSON.stringify(clazz)\"\n\n# Memory string search\nmemory search \"password\" --string\nmemory search \"api_key\" --string\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Instrumentation** | Modifying application behavior at runtime by injecting code into the running process |\n| **Method Hooking** | Replacing or wrapping function implementations to intercept arguments and return values |\n| **Frida Server** | Daemon running on the target device that receives instrumentation commands from the host |\n| **Dalvik\u002FART Runtime** | Android runtime environments; Frida hooks at the ART level for Java\u002FKotlin methods |\n| **Heap Inspection** | Examining live objects in the application's memory heap to extract runtime data |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation toolkit for injecting JavaScript into native Android processes\n- **Objection**: Higher-level Frida wrapper with pre-built Android and iOS security testing commands\n- **frida-trace**: Automated method tracing utility for quick reconnaissance of app behavior\n- **Drozer**: Android security assessment framework for testing IPC and exported components\n- **Android Studio Profiler**: Runtime monitoring for CPU, memory, and network activity\n\n## Common Pitfalls\n\n- **Frida version mismatch**: The Frida server on the device must match the frida-tools version on the host. Version mismatches cause connection failures.\n- **Anti-Frida detection**: Some apps detect Frida by checking for the Frida server process, scanning memory for Frida signatures, or monitoring `\u002Fproc\u002Fself\u002Fmaps`. Use Frida Gadget injection or custom server builds.\n- **Obfuscated class names**: When ProGuard\u002FR8 is applied, class and method names are shortened (e.g., `a.b.c.d()`). Use `android hooking search classes` to discover actual runtime names.\n- **Multi-DEX apps**: Large apps split across multiple DEX files may not have all classes loaded at startup. Hook class loaders or use `Java.enumerateLoadedClasses()` after app is fully initialized.\n","# Performing Dynamic Analysis of Android App\n\n## When to Use\n\nUse this skill when:\n- Static analysis results need runtime validation on an actual Android device\n- The target app uses obfuscation (DexGuard, custom packers) that prevents effective static analysis\n- Testing requires observing actual API calls, decrypted data, or runtime-generated values\n- Assessing root detection, tamper detection, or anti-debugging implementations\n\n**Do not use** this skill on production environments without authorization -- dynamic instrumentation can alter app behavior and trigger security alerts.\n\n## Prerequisites\n\n- Rooted Android device or emulator (Genymotion, Android Studio AVD with writable system)\n- Frida server installed on device matching the architecture (arm64, x86_64)\n- Python 3.10+ with `frida-tools` and `objection` packages\n- ADB configured and device connected\n- Target APK installed on device\n\n## Workflow\n\n### Step 1: Setup Frida Server on Android Device\n\n```bash\n# Check device architecture\nadb shell getprop ro.product.cpu.abi\n# Output: arm64-v8a\n\n# Download matching Frida server from GitHub releases\n# https:\u002F\u002Fgithub.com\u002Ffrida\u002Ffrida\u002Freleases\n# Push to device\nadb push frida-server-16.x.x-android-arm64 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server\nadb shell chmod 755 \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server\nadb shell \u002Fdata\u002Flocal\u002Ftmp\u002Ffrida-server &\n\n# Verify Frida connection\nfrida-ps -U\n```\n\n### Step 2: Enumerate Application Attack Surface\n\n```bash\n# List all packages\nfrida-ps -U -a\n\n# Attach Objection for high-level exploration\nobjection --gadget com.target.app explore\n\n# List activities, services, receivers\nandroid hooking list activities\nandroid hooking list services\nandroid hooking list receivers\n\n# List loaded classes\nandroid hooking list classes\nandroid hooking search classes com.target.app\n```\n\n### Step 3: Hook Sensitive Methods\n\n```bash\n# Hook all methods of a class\nandroid hooking watch class com.target.app.auth.LoginManager\n\n# Hook specific method with argument dumping\nandroid hooking watch class_method com.target.app.auth.LoginManager.authenticate --dump-args --dump-return\n\n# Hook crypto operations\nandroid hooking watch class javax.crypto.Cipher --dump-args\nandroid hooking watch class java.security.MessageDigest --dump-args\n\n# Hook network calls\nandroid hooking watch class okhttp3.OkHttpClient --dump-args\nandroid hooking watch class java.net.URL --dump-args\n```\n\n### Step 4: Write Custom Frida Scripts for Deep Analysis\n\n```javascript\n\u002F\u002F hook_crypto.js - Intercept encryption\u002Fdecryption operations\nJava.perform(function() {\n    var Cipher = Java.use(\"javax.crypto.Cipher\");\n\n    Cipher.doFinal.overload(\"[B\").implementation = function(input) {\n        var mode = this.getAlgorithm();\n        console.log(\"[Cipher] Algorithm: \" + mode);\n        console.log(\"[Cipher] Input: \" + bytesToHex(input));\n\n        var result = this.doFinal(input);\n        console.log(\"[Cipher] Output: \" + bytesToHex(result));\n        return result;\n    };\n\n    function bytesToHex(bytes) {\n        var hex = [];\n        for (var i = 0; i \u003C bytes.length; i++) {\n            hex.push((\"0\" + (bytes[i] & 0xFF).toString(16)).slice(-2));\n        }\n        return hex.join(\"\");\n    }\n});\n```\n\n```bash\n# Execute custom Frida script\nfrida -U -f com.target.app -l hook_crypto.js --no-pause\n```\n\n### Step 5: Bypass Root Detection\n\n```javascript\n\u002F\u002F root_bypass.js - Common root detection bypass\nJava.perform(function() {\n    \u002F\u002F Bypass RootBeer library\n    var RootBeer = Java.use(\"com.scottyab.rootbeer.RootBeer\");\n    RootBeer.isRooted.implementation = function() {\n        console.log(\"[RootBeer] isRooted() bypassed\");\n        return false;\n    };\n\n    \u002F\u002F Bypass generic file-based root checks\n    var File = Java.use(\"java.io.File\");\n    var originalExists = File.exists;\n    File.exists.implementation = function() {\n        var path = this.getAbsolutePath();\n        var rootPaths = [\"\u002Fsystem\u002Fapp\u002FSuperuser.apk\", \"\u002Fsystem\u002Fxbin\u002Fsu\",\n                         \"\u002Fsbin\u002Fsu\", \"\u002Fsystem\u002Fbin\u002Fsu\", \"\u002Fdata\u002Flocal\u002Fbin\u002Fsu\"];\n        if (rootPaths.indexOf(path) >= 0) {\n            console.log(\"[Root] Blocked check for: \" + path);\n            return false;\n        }\n        return originalExists.call(this);\n    };\n\n    \u002F\u002F Bypass SafetyNet\u002FPlay Integrity\n    try {\n        var SafetyNet = Java.use(\"com.google.android.gms.safetynet.SafetyNetApi\");\n        console.log(\"[SafetyNet] Class found - may need additional bypass\");\n    } catch(e) {}\n});\n```\n\n### Step 6: Analyze Network Communication at Runtime\n\n```javascript\n\u002F\u002F network_monitor.js - Monitor all HTTP requests\nJava.perform(function() {\n    \u002F\u002F Hook OkHttp3\n    try {\n        var OkHttpClient = Java.use(\"okhttp3.OkHttpClient\");\n        var Interceptor = Java.use(\"okhttp3.Interceptor\");\n        var Chain = Java.use(\"okhttp3.Interceptor$Chain\");\n\n        console.log(\"[OkHttp] Monitoring network requests...\");\n\n        var Request = Java.use(\"okhttp3.Request\");\n        Request.url.implementation = function() {\n            var url = this.url();\n            console.log(\"[OkHttp] URL: \" + url.toString());\n            return url;\n        };\n    } catch(e) {\n        console.log(\"[OkHttp] Not found, trying HttpURLConnection\");\n    }\n\n    \u002F\u002F Hook HttpURLConnection\n    var URL = Java.use(\"java.net.URL\");\n    URL.openConnection.overload().implementation = function() {\n        console.log(\"[URL] Opening: \" + this.toString());\n        return this.openConnection();\n    };\n});\n```\n\n### Step 7: Extract Decrypted Data and Secrets\n\n```bash\n# Using Objection for quick extraction\nobjection --gadget com.target.app explore\n\n# Dump Android Keystore entries\nandroid keystore list\nandroid keystore dump\n\n# Search heap for sensitive objects\nandroid heap search instances com.target.app.model.User\nandroid heap evaluate \u003Chandle> \"JSON.stringify(clazz)\"\n\n# Memory string search\nmemory search \"password\" --string\nmemory search \"api_key\" --string\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Dynamic Instrumentation** | Modifying application behavior at runtime by injecting code into the running process |\n| **Method Hooking** | Replacing or wrapping function implementations to intercept arguments and return values |\n| **Frida Server** | Daemon running on the target device that receives instrumentation commands from the host |\n| **Dalvik\u002FART Runtime** | Android runtime environments; Frida hooks at the ART level for Java\u002FKotlin methods |\n| **Heap Inspection** | Examining live objects in the application's memory heap to extract runtime data |\n\n## Tools & Systems\n\n- **Frida**: Dynamic instrumentation toolkit for injecting JavaScript into native Android processes\n- **Objection**: Higher-level Frida wrapper with pre-built Android and iOS security testing commands\n- **frida-trace**: Automated method tracing utility for quick reconnaissance of app behavior\n- **Drozer**: Android security assessment framework for testing IPC and exported components\n- **Android Studio Profiler**: Runtime monitoring for CPU, memory, and network activity\n\n## Common Pitfalls\n\n- **Frida version mismatch**: The Frida server on the device must match the frida-tools version on the host. Version mismatches cause connection failures.\n- **Anti-Frida detection**: Some apps detect Frida by checking for the Frida server process, scanning memory for Frida signatures, or monitoring `\u002Fproc\u002Fself\u002Fmaps`. Use Frida Gadget injection or custom server builds.\n- **Obfuscated class names**: When ProGuard\u002FR8 is applied, class and method names are shortened (e.g., `a.b.c.d()`). Use `android hooking search classes` to discover actual runtime names.\n- **Multi-DEX apps**: Large apps split across multiple DEX files may not have all classes loaded at startup. Hook class loaders or use `Java.enumerateLoadedClasses()` after app is fully initialized.\n",{"name":5,"tags":52,"author":54,"domain":46,"license":15,"version":55,"nist_csf":56,"subdomain":43,"description":61,"mitre_attack":62},[43,27,41,30,40,53],"penetration-testing","mahipal","1.0.0",[57,58,59,60],"PR.PS-01","PR.AA-05","ID.RA-01","DE.CM-09","Performs runtime dynamic analysis of Android applications using Frida, Objection, and Android Debug Bridge to observe application behavior during execution, intercept function calls, modify runtime values, and identify vulnerabilities that static analysis misses. Use when testing Android apps for runtime security flaws, hooking sensitive methods, bypassing client-side protections, or analyzing obfuscated applications. Activates for requests involving Android dynamic analysis, runtime hooking, Frida Android instrumentation, or live app behavior analysis.\n",[63,64,65,66,67],"T1059","T1056","T1036","T1078","T1027","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-dynamic-analysis-of-android-app",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dynamic-analysis-of-android-app",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dynamic-analysis-of-android-app",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-dynamic-analysis-of-android-app","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002FSKILL.md",true,[92,98,103,109,113,117,123],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1270,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1415,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fstandards.md",2158,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Freferences\u002Fstandards.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fworkflows.md",2796,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Freferences\u002Fworkflows.md",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fagent.py","SCRIPT","脚本",6325,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Fscripts\u002Fagent.py",{"path":124,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fprocess.py",9034,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-dynamic-analysis-of-android-app\u002Fscripts\u002Fprocess.py",[128,153,177,201,227,254],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":135,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[134],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[136,137,138,139,32,46,140,141,44,142,143,144,145,146,147,148,149,150,151,152],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":160,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[159],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[161,149,162,163,32,164,46,44,165,166,167,168,169,170,171,172,173,174,175,176],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":185,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[183,184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[171,186,187,188,31,46,189,190,165,191,192,193,194,195,196,36,197,198,199,200],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[209,210,211,46,212,213,214,215,216,217,218,219,220,221,222,223,168,224,225,226],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[233],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[235,236,237,46,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":255,"name":256,"nameZh":6,"description":257,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":258,"categories":259,"keywords":261,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[260],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[32,262,46,263,264,265,266,267,268,269,270,36,35,197,29,271,272,273,274,275],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]