{"slug":"shuvonsec-mobile-pentest","source_name":"shuvonsec/mobile-pentest","name":"Shuvonsec/Mobile Pentest","description":"Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInterf","version":1,"lift":{"pass_rate_delta_pts":18.18,"pass_rate_pct":81.8,"total_cases":22,"passed_cases":18,"tokens_delta_pct":213.2,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-10T08:14:33.476126+00:00"},"skill_score":null,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":18.18,"with_pass_pct":81.8,"without_pass_pct":63.6,"tokens_delta_pct":213.2,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-10T08:14:33.476126+00:00","run_id":"56b3dc25-b120-41b0-ab1e-7660004bec6e","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"manifest_hash":"f71519a6fb6d650e024c9389d30efbce7c77529406eced984bc55cc0ea7da6e4","raw_url":"https://app.decimal.ai/s/shuvonsec-mobile-pentest/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/shuvonsec-mobile-pentest"}