Same brain, a new surface
Nothing about the approach changes: the skills teach the methodology, the model invents the attack, and the chain assembles itself. What’s new is where you can point it. /android-security and /ios-security bring mobile into the same self-chaining engagement that already covers web, network, cloud, AD, and AI red-team—mapped to the OWASP Mobile Application Security Verification Standard (MASVS) and the Mobile Application Security Testing Guide (MASTG), the way the web skills map to ASVS.
Static analysis—no device required
Hand Smith a built artifact or the source and it pulls the app apart before anything ever runs:
- MobSF for a MASVS-mapped static report on the APK/IPA.
- jadx / apktool to decompile Android; class-dump to recover Objective-C headers on iOS.
- mobsfscan as a mobile-aware SAST pass over the source tree.
That surfaces the usual suspects—hardcoded secrets and API keys, insecure data storage, exported components and unprotected deep links, weak or home-rolled crypto, missing certificate pinning, and debuggable/backup-enabled builds—each tracked as a closable MASVS control, not a wall of scanner text.
Dynamic analysis—on a real device
Static tells you what could break; dynamic proves it. On an operator-provided rooted or jailbroken device (Smith opens a non-blocking setup gate and verifies the hookable runtime before it relies on it), it drives Frida and objection to:
- bypass SSL pinning and watch the real traffic,
- read the Keychain / Keystore and on-disk state at runtime,
- hook auth and jailbreak/root-detection logic, and
- abuse IPC, intents, and deep links from a hostile app’s perspective.
Then it follows the traffic
Here’s where being one agent pays off. The moment Smith sees the API the app talks to, it chains into /api-security and /web-exploit and tests that backend too—auth, BOLA/IDOR, injection, business logic—linking every mobile finding and every API finding into the same world model. The client and the server get tested in one run, by the same brain, with shared context.
Coverage you can prove
/masvs-checklist tracks the engagement against the MASVS controls the same way the coverage matrix tracks endpoint×technique for web—so “done” is an honest, auditable number, and /mobile-pentest-plan scopes the work up front. Static runs anywhere; only the dynamic phase needs a device, and Smith is explicit about which controls it could and couldn’t reach.
The mobile skills are open source alongside the rest on the Agent-Smith repo. Point it at an app and see what falls out.