security-mcp 1.1.4 → 1.3.1

package/skills/mobile-api-network-attacker/SKILL.md

@@ -79,3 +79,424 @@ certificate pinning bypass vectors, and GraphQL/REST endpoint exposure gaps.
 - Hardcoded secret location or API vulnerability
 - Mobile-specific exploit scenario
 - Fix applied to code or API configuration
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+### Expansion 1 — Frida-Based Certificate Pinning Bypass (CVE-Class: Platform Trust Abuse)
+
+**Technique:** Use Frida dynamic instrumentation to hook `SecTrustEvaluate` (iOS) or
+`X509TrustManager.checkServerTrusted` (Android) at runtime and force a trust decision of
+`errSecSuccess` / no-throw regardless of the certificate presented. This defeats both native
+cert pinning and most SDK-level pinning (TrustKit, OkHttp `CertificatePinner`).
+
+**Concrete test:**
+```bash
+# Attach Frida to running app process
+frida -U -l ssl_bypass.js -f com.target.app --no-pause
+# ssl_bypass.js — universal bypass script (objection ships one)
+objection -g com.target.app explore
+# then: ios sslpinning disable   OR   android sslpinning disable
+```
+**Finding if:** MitM proxy (Burp/Charles) captures decrypted API traffic after Frida hook
+is active. Indicates pinning is bypassable at runtime — even if statically verified.
+
+**Mitigation check:** Verify the app uses jailbreak/root detection AND integrity attestation
+(Google Play Integrity API / Apple DeviceCheck) so that a Frida-attached process is refused
+by the backend, not just by the client-side pin.
+
+---
+
+### Expansion 2 — Binary Secret Extraction via strings + Radare2 / jadx
+
+**Technique:** Strip the IPA or APK, run `strings` over the binary, and pipe through entropy
+analysis to surface high-entropy blobs (API keys, JWT secrets, AES keys). Then use `jadx` or
+`r2` to find the call site and understand how the secret is used.
+
+**Concrete test:**
+```bash
+# Android: decompile APK
+jadx -d out/ target.apk
+grep -rE '[A-Za-z0-9_\-]{32,}' out/ | grep -viE 'import|package|class|layout'
+
+# iOS: extract binary from IPA, scan with rabin2
+unzip -o target.ipa && rabin2 -z Payload/App.app/App | awk 'length($NF) > 30'
+
+# Entropy sweep (detect base64 keys)
+python3 -c "
+import math, re, sys
+data = open(sys.argv[1]).read()
+for m in re.findall(r'[A-Za-z0-9+/=]{32,}', data):
+    h = -sum(p*math.log2(p) for c in set(m) if (p := m.count(c)/len(m)) > 0)
+    if h > 4.5: print(h, m)
+" out/sources/com/target/app/BuildConfig.java
+```
+**Finding if:** Secret with entropy > 4.5 found in decompiled source that matches a live
+credential (confirm with a real API call).
+
+---
+
+### Expansion 3 — OAuth PKCE Downgrade via Custom URI Scheme Hijacking (CVE-2019-9700 class)
+
+**Technique:** Android apps that register a custom URI scheme (`myapp://callback`) for OAuth
+redirect are vulnerable to scheme hijacking: a malicious app registers the same scheme and
+intercepts the authorization code. Without PKCE, the hijacker can exchange the code for tokens.
+
+**Concrete test:**
+1. Inspect `AndroidManifest.xml` for `<intent-filter>` with `<data android:scheme="myapp"/>`.
+2. Register a second test APK with the identical scheme.
+3. Initiate OAuth login on the victim app — observe which app receives the callback.
+4. Without PKCE (`code_challenge` absent in `/authorize` request), exchange the code:
+```bash
+curl -X POST https://auth.target.com/oauth/token \
+  -d 'grant_type=authorization_code&code=INTERCEPTED_CODE&redirect_uri=myapp://callback&client_id=...'
+```
+**Finding if:** Token exchange succeeds without `code_verifier`.
+
+---
+
+### Expansion 4 — GraphQL Batch Query Amplification DoS
+
+**Technique:** GraphQL allows multiple operations in a single HTTP request (batching). Without
+a per-request complexity budget, an attacker sends a batch of 100 identical expensive queries,
+each resolving N+1 DB calls, multiplying backend load by 100× with a single HTTP request.
+
+**Concrete test:**
+```bash
+curl -X POST https://api.target.com/graphql \
+  -H 'Content-Type: application/json' \
+  -d '[
+    {"query": "{ users { id orders { id items { id product { id reviews { id } } } } } }"},
+    {"query": "{ users { id orders { id items { id product { id reviews { id } } } } } }"}
+  ]'
+# Repeat 100x in the array; measure response time vs single query
+```
+**Finding if:** Batch of 50 queries completes in < 2× the time of a single query (server is
+parallelising without complexity limits), or the server returns HTTP 200 with all results
+(no batch size limit).
+
+---
+
+### Expansion 5 — Firebase Security Rules Privilege Escalation (CVE-class: Misconfigured NoSQL)
+
+**Technique:** Firebase Realtime Database and Firestore rules are frequently misconfigured to
+allow reads or writes when `auth != null`, without validating the authenticated user's
+relationship to the data being accessed (i.e., horizontal privilege escalation).
+
+**Concrete test:**
+```javascript
+// Using Firebase JS SDK with a legitimately authenticated user
+const db = firebase.firestore();
+// Try reading another user's private document
+const snap = await db.collection('users').doc('victim-uid').get();
+console.log(snap.exists, snap.data());
+// Try writing to another user's document
+await db.collection('users').doc('victim-uid').update({ email: 'attacker@evil.com' });
+```
+Also check rules source directly:
+```bash
+# Download rules via Firebase CLI
+firebase firestore:rules:list
+# Look for: allow read, write: if request.auth != null;
+# (no uid check = IDOR for all authenticated users)
+```
+
+---
+
+### Expansion 6 — AI-Assisted API Fuzzing via LLM-Generated Payloads (Post-2024 Threat)
+
+**Technique:** Adversaries now use LLMs (GPT-4o, local Llama 3 fine-tuned on API specs) to
+auto-generate semantically valid but malicious request bodies that pass schema validation
+while exploiting business logic. Unlike dumb fuzzing, LLM fuzzing understands field semantics
+(e.g., sets `quantity: -1` or `role: "admin"` in a user-supplied patch body).
+
+**Concrete test:**
+```python
+# Feed OpenAPI spec to LLM, ask for adversarial payloads
+import anthropic
+client = anthropic.Anthropic()
+spec = open("openapi.yaml").read()
+response = client.messages.create(
+    model="claude-sonnet-4-6",
+    max_tokens=2048,
+    messages=[{
+        "role": "user",
+        "content": f"Given this API spec, generate 10 adversarial payloads targeting IDOR, privilege escalation, and negative quantity exploits:\n{spec}"
+    }]
+)
+# Send each generated payload to the API; measure server behaviour
+```
+**Finding if:** Server returns HTTP 200 or 201 for payloads that should be rejected by
+business logic (negative values, escalated roles, cross-user resource IDs).
+
+---
+
+### Expansion 7 — LLM-Assisted Mobile Binary Analysis for Obfuscated Secrets (Post-2024 Threat)
+
+**Technique:** Attackers (and defenders) now feed decompiled smali/LLVM IR to LLMs to
+identify obfuscated secret assembly — strings split across multiple functions, XOR-decoded at
+runtime, or base64-encoded fragments concatenated at call time. Classic `strings` misses these.
+
+**Concrete test:**
+1. Decompile APK to smali with `apktool d target.apk`.
+2. Feed suspicious smali classes to an LLM with prompt: "Identify any string construction
+   patterns that assemble a secret key or API credential at runtime."
+3. Trace identified assembly patterns through dynamic analysis (Frida `Interceptor.attach`
+   on the final concatenation point) to capture the runtime value.
+
+**Finding if:** Runtime-captured string matches a live API credential or secret format
+(UUID, JWT, AWS key prefix `AKIA`, Stripe key prefix `sk_live_`).
+
+---
+
+### Expansion 8 — API Gateway Bypass via Host Header Injection to Internal Services
+
+**Technique:** Mobile apps sometimes contact an API gateway that proxies to internal
+microservices. If the gateway routes based on the `Host` header and does not validate it
+against an allowlist, an attacker can inject a host header pointing to an internal service
+address, potentially bypassing gateway-level auth enforcement.
+
+**Concrete test:**
+```bash
+# Standard request through gateway
+curl -H 'Host: api.target.com' https://api.target.com/v1/users
+
+# Inject internal host to attempt bypass
+curl -H 'Host: internal-users-service.default.svc.cluster.local' \
+     -H 'X-Forwarded-Host: internal-users-service.default.svc.cluster.local' \
+     https://api.target.com/v1/users
+
+# Check if response differs (bypasses auth, returns different data, or errors reveal internals)
+```
+**Finding if:** Response status, body, or headers differ when internal host is injected,
+or if `Server` / `X-Powered-By` headers reveal an internal service name.
+
+---
+
+## §MOBILE_API_NETWORK_ATTACKER-CHECKLIST
+
+1. **Hardcoded credential sweep** — Run entropy analysis + regex scan across all
+   decompiled/source files. Search for patterns: `api_key`, `client_secret`, `AKIA`,
+   `sk_live_`, `Bearer `. Finding: any credential with entropy > 4.5 present in binary.
+
+2. **Certificate pinning bypass via Frida** — Attach Frida/objection to the running app,
+   execute `ssl_pinning disable`, and attempt MitM with Burp. Finding: decrypted API traffic
+   captured in proxy after bypass.
+
+3. **Network Security Config review (Android)** — Read `res/xml/network_security_config.xml`.
+   Check `cleartextTrafficPermitted`, `<trust-anchors>` scope, and `<pin-set>` backup pins.
+   Finding: `cleartextTrafficPermitted="true"` in production config, or missing backup pins.
+
+4. **iOS App Transport Security exceptions** — Parse `Info.plist` for
+   `NSAppTransportSecurity` keys. Finding: `NSAllowsArbitraryLoads: true` or domain-specific
+   exceptions for production hosts.
+
+5. **Token storage security** — Check iOS Keychain usage class (`kSecAttrAccessible*`);
+   check Android `EncryptedSharedPreferences` vs plain `SharedPreferences`. Finding: tokens
+   stored in `UserDefaults` / plain `SharedPreferences` / accessible after device unlock.
+
+6. **OAuth PKCE enforcement** — Intercept `/authorize` request; confirm `code_challenge`
+   and `code_challenge_method=S256` present. Finding: absent `code_challenge`, or
+   `code_challenge_method=plain` used.
+
+7. **Custom URI scheme hijacking risk** — Inspect `AndroidManifest.xml` for custom schemes.
+   Register a competing APK with the same scheme. Finding: competing app receives OAuth callback.
+
+8. **GraphQL introspection in production** — Send `{ __schema { types { name } } }` to
+   the GraphQL endpoint without auth. Finding: full type list returned (200 OK with schema).
+
+9. **GraphQL depth and complexity limits** — Send a deeply nested query (10+ levels) and a
+   batch of 50 queries. Finding: server returns all results without HTTP 400 or complexity error.
+
+10. **API versioning gap** — Enumerate `/api/v1/`, `/api/v2/`, `/api/` (versionless), and
+    `/api/internal/` paths. Finding: older version or internal path accessible with no auth or
+    different, weaker auth than the current version.
+
+11. **Push notification payload PII** — Review server-side push notification construction
+    code. Search for PII fields passed in APNs/FCM `data` payload. Finding: `email`, `phone`,
+    `name`, or financial data present in notification payload body.
+
+12. **Firebase / Firestore rules IDOR** — Authenticate as User A; attempt read/write on
+    User B's documents using the Firebase SDK. Finding: operation succeeds, or rules contain
+    `allow read, write: if request.auth != null` without UID-scoped path matching.
+
+---
+
+## §POC-REQUIREMENT
+
+Every finding reported by this agent MUST follow this exact lifecycle before being recorded
+at the assigned severity:
+
+1. **Write working PoC FIRST** — Document the exact payload, request, tool command, or
+   code snippet used. Include observed server response (status code, body excerpt, screenshot
+   reference). This must be reproducible by a person who was not present during the test.
+
+2. **Confirm reproduction** — Execute the PoC a second time (different session, different
+   token if applicable) and confirm the same result. Note any environmental preconditions
+   (Frida attached, specific app version, authenticated vs unauthenticated).
+
+3. **Write fix** — Implement the remediation in code or configuration. Document what changed
+   and why it closes the attack path.
+
+4. **Verify PoC fails against fix** — Re-execute the identical PoC against the patched
+   code or configuration. Confirm the attack no longer succeeds (expected: HTTP 400/401/403,
+   pinning error, or no traffic captured).
+
+5. **Record in findings JSON** — Add the `exploitPoC` field to the finding object:
+   ```json
+   {
+     "exploitPoC": {
+       "command": "objection -g com.target.app explore -- ios sslpinning disable",
+       "observedImpact": "All HTTPS traffic decrypted in Burp proxy",
+       "reproduced": true,
+       "fixVerified": true
+     }
+   }
+   ```
+
+**PoC skipping = severity automatically downgraded to MEDIUM**, regardless of the theoretical
+severity assigned. This rule is enforced by the orchestrator during Phase 2 synthesis.
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately halt current work, emit an `ESCALATION` event to the orchestrator, and mark the
+run as `REPRIORITIZE` if any of the following conditions are observed:
+
+1. **Live production credentials found in binary** — Any API key, JWT secret, OAuth client
+   secret, or cloud provider key (`AKIA*`, `sk_live_*`, private key PEM block) found in a
+   decompiled production binary. Impact: immediate account takeover or data exfiltration.
+   Escalate before attempting any further exploitation.
+
+2. **Authentication bypass on a production mobile endpoint** — A mobile-only API endpoint
+   accepts requests without any authentication token and returns non-public data (user
+   records, financial data, PII). This is a P0 data breach condition.
+
+3. **GraphQL introspection + zero field-level authorization** — Introspection is enabled
+   AND at least one sensitive type (user, payment, admin) has resolvers with no `@auth`
+   directive or middleware guard. Combination creates a full schema + data extraction path.
+
+4. **Firebase rules `allow read, write: if true`** — Open database rules in production.
+   This is a complete data breach; all data is publicly readable and writable. No further
+   testing needed — escalate immediately.
+
+5. **Certificate pinning absent AND token not bound to device** — If MitM succeeds (no
+   pinning) AND the access token can be replayed from a different device/IP without error,
+   the session is fully portable. An attacker who intercepts once can replay indefinitely.
+
+6. **Supply chain secret in a third-party SDK bundled into the app** — A bundled SDK
+   (analytics, payments, ads) contains hardcoded credentials that are shared across all
+   apps using that SDK version. This is a multi-tenant credential exposure affecting all
+   users of the SDK, not just this app.
+
+7. **OAuth authorization code interceptable + PKCE absent** — Custom URI scheme registered
+   without PKCE enforcement, confirmed by successful token exchange with an intercepted code.
+   This is a complete account takeover vector requiring no user interaction beyond initiating
+   a login flow.
+
+8. **LLM-generated payload causes server-side data mutation** — During AI-assisted fuzzing,
+   a generated payload causes an unintended write (role escalation, balance manipulation,
+   data deletion) in a staging or production environment. Indicates business logic is
+   exploitable at scale by automated adversaries.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+**Mobile-API-specific detection gaps:**
+
+- **Runtime pinning bypass via Frida**: No network log entry differs from a legitimate request. Need: backend DeviceCheck / Play Integrity attestation verification on every sensitive API call — reject requests from processes that fail integrity attestation.
+- **Binary secret extraction**: Occurs entirely offline before any network request is made. Need: rotate credentials on a schedule short enough that extracted credentials expire before they can be exploited; enforce per-device, short-lived token issuance.
+- **GraphQL complexity abuse**: Standard WAF rules match on string patterns, not on query depth or resolver fan-out. Need: server-side query complexity analysis library (e.g., `graphql-cost-analysis`) with hard reject above threshold.
+- **OAuth code interception via URI scheme**: Legitimate and malicious app both appear as valid redirects in OS logs. Need: enforce PKCE S256 server-side and reject any `/token` request lacking `code_verifier`.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "Hardcoded Secrets", "filesReviewed": 312, "patterns": ["api_key", "client_secret", "AKIA", "sk_live_", "Bearer "], "result": "CLEAN" }],
+    "filesReviewed": 312,
+    "negativeAssertions": ["Hardcoded Secrets: entropy + regex sweep across 312 decompiled files — 0 matches above threshold"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "mobile-api-network-attacker",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.

package/skills/mobile-binary-hardener/SKILL.md

@@ -197,3 +197,105 @@ module.exports = {
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST also include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "e.g. Frida-injectable process — debuggable release flag set", "exploitHint": "Attach Frida to PID; hook target class methods to bypass auth checks" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "e.g. hardcoded AES key in NDK native library", "location": "lib/arm64-v8a/libnative.so offset 0x2a10" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "e.g. hardcoded cloud endpoint in BuildConfig", "escalationPath": "Endpoint accepts unauthenticated requests if binary is repackaged with modified flag" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 6.3.3", "OWASP M7:2024"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Assisted Semantic Deobfuscation via LLM-Enhanced Jadx (ATT&CK T1027.002):** Modern toolchains (e.g., jadx-ai forks, GPT-4-augmented decompilers) recover semantic class/method names from ProGuard-obfuscated bytecode by pattern-matching against training data of known Android SDK call graphs. ProGuard dictionary obfuscation alone is defeated. Test by: decompile a release APK with jadx 1.4+; feed output to GPT-4 with the prompt "identify what this class does"; if the model names the class function correctly (e.g., "payment processor", "biometric auth"), obfuscation is insufficient. Finding threshold: any class handling PII, auth, or payment that is semantically recoverable in <3 LLM prompts.
+
+- **Supply Chain: Malicious AAR/Gradle Plugin Injecting Backdoored Native Library (CVE-2023-26048 pattern, ATT&CK T1195.001):** Compromised Gradle plugins or transitive AAR dependencies have injected `libmalicious.so` into `jniLibs/` during the build phase — invisible to source code review. The Jetpack / Google Maven supply chain was targeted in the ShadowSDK campaign (2024). Test by: run `./gradlew dependencies --configuration releaseRuntimeClasspath > deps.txt`; cross-reference every native `.so` in the final APK against the dependency tree using `apktool d` + `sha256sum`; any `.so` not traceable to a pinned dependency version is a finding. Finding threshold: one unattributed native library.
+
+- **Post-Quantum Threat: Harvest-Now-Decrypt APK Code-Signing (NIST FIPS 204 / ML-DSA migration):** Adversaries are archiving signed APKs and IPA bundles today. When a Cryptographically Relevant Quantum Computer (CRQC) becomes available (~2029–2032), RSA-2048 and ECDSA P-256 code-signing certificates used today will be forgeable retroactively, enabling undetectable APK repackaging of archived builds. Test by: run `apksigner verify --print-certs app-release.apk | grep -E "algorithm|key size"`; flag any signing cert using RSA < 4096 or ECDSA P-256/P-384. Finding threshold: any release signing key not on the ML-DSA (FIPS 204) migration roadmap documented in the project.
+
+- **EU Cyber Resilience Act (CRA) SBOM Mandate — Missing Build Provenance Attestation (Regulatory, effective 2027):** The EU CRA requires manufacturers of apps with "digital elements" to provide a machine-readable SBOM (CycloneDX or SPDX) and SLSA build provenance attestation per release. Non-compliance blocks EU market access. Test by: verify a `cyclonedx-gradle-plugin` or `spdx-gradle-plugin` task is wired into the release build; run `./gradlew cyclonedxBom` and confirm output exists; check that the CI pipeline uploads a signed SLSA provenance attestation (`slsa-github-generator` or equivalent). Finding threshold: any release build lacking a valid signed SBOM artifact.
+
+- **Dynamic Code Loading Integrity Bypass via OTA JS Bundle Replacement (CVE-2022-22972 pattern, ATT&CK T1055.001):** React Native and Expo apps using CodePush or custom OTA update mechanisms fetch JS bundles over HTTPS but often skip signature verification of the bundle payload itself. A MitM or compromised CDN delivers a malicious bundle that executes arbitrary JS in the app's native context, bypassing App Store review entirely. Test by: grep for `DexClassLoader`, `PathClassLoader`, `codePush.sync`, `Updates.fetchUpdateAsync` in source; intercept OTA traffic with mitmproxy and replace the bundle with a modified version; if the app executes the replaced bundle without rejecting it, the control is absent. Finding threshold: any OTA update path lacking ECDSA/RSA bundle signature verification checked at load time.
+
+- **Frida Gadget Embedded in Third-Party SDK — Detection Evasion via Renamed Library (ATT&CK T1036.005):** Security researchers (NCC Group, 2024) documented Frida gadget (`libfrida-gadget.so`) shipped inside commercial analytics and ad-network SDKs under renamed filenames (e.g., `libmetrics_core.so`, `libanalytics_rt.so`) to evade name-based detection. The gadget enables remote JS injection into a production app at runtime on non-rooted devices via the Frida server protocol. Test by: extract APK with `apktool d`; for every `.so` in `lib/`, run `strings <lib>.so | grep -i "frida\|gadget\|gum-js\|GumScript"`; additionally check ELF section names with `readelf -S <lib>.so | grep frida`. Finding threshold: any `.so` whose strings or ELF sections reference Frida internals, regardless of filename.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in mobile binary hardening that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | ProGuard rule `keep` wildcard preserving entire sensitive packages | Static analysis sees `minifyEnabled = true` and marks it safe; wildcard `-keep class com.example.**` negates all obfuscation for that subtree | Parse all `proguard-rules.pro` / consumer-rules files; flag any `-keep class <pkg>.**` covering auth, crypto, or networking packages |
+| 2 | Frida-gadget embedded in third-party SDK inside the APK | Scanner audits first-party code; vendored or repackaged SDKs may ship `libfrida-gadget.so` in `lib/` | Run `find . -name "libfrida-gadget.so" -o -name "frida-gadget*"` inside extracted APK; check `jniLibs/` and AAR exploded directories |
+| 3 | Debug signing certificate used in an APK labelled `release` | Build pipeline misconfiguration; scanner checks `debuggable` flag but not signing certificate DN | Run `apksigner verify --print-certs app.apk` and confirm `CN` is not `Android Debug` or self-signed with `O=Android` |
+| 4 | React Native / Flutter JS bundle bypassing native ProGuard entirely | ProGuard only operates on JVM bytecode; the JS/Dart bundle at `assets/index.android.bundle` ships in plaintext | Extract APK; check that `assets/index.android.bundle` is minified and does not contain raw source identifiers, internal URLs, or `console.log` |
+| 5 | iOS App Store binary containing dyld-injectable `@rpath` entries pointing to non-existent frameworks (dylib hijacking surface) | Xcode project compiles cleanly; hijack surface only visible in linked binary's load commands | Run `otool -L YourApp.app/YourApp` and verify every `@rpath` entry resolves to a framework shipped in the `.app` bundle; flag dangling entries |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that mobile binary hardening defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Mobile Binary Hardening | Prepare Now By |
+|--------|--------------|---------------------------------------|----------------|
+| AI-assisted APK deobfuscation at scale | 2025–2027 (active) | LLM + symbolic execution tools (e.g. LLM-enhanced jadx) recover semantic class names from obfuscated bytecode; ProGuard-only obfuscation is no longer a meaningful barrier | Layer RASP runtime checks and jailbreak/root detection on top of obfuscation; treat obfuscation as delay, not defence |
+| Cryptographically Relevant Quantum Computer (CRQC) breaking RSA/ECDSA code-signing | 2028–2032 | Harvest-now-execute-later: adversaries archive signed APKs today and will forge equivalent signatures when CRQC arrives, enabling undetected repackaging | Inventory all RSA/ECDSA signing key sizes; plan migration to ML-DSA (FIPS 204) as Google Play and Apple App Store add support |
+| Mandatory SBOM + build provenance for mobile apps (EU CRA / US EO 14028) | 2025–2026 (active) | Regulators will require CycloneDX/SPDX SBOM and SLSA build attestation for app store submissions in regulated sectors | Generate SBOM per release build; achieve SLSA L2 minimum (hosted build, signed provenance) |
+| Dynamic Code Loading (DCL) abuse via legitimate update frameworks | 2026–2027 | Attackers target apps that use `DexClassLoader` or OTA JS bundle updates to push malicious payloads post-install, bypassing store review | Audit all `DexClassLoader`, `PathClassLoader`, and JS engine bundle-load paths; enforce code-signing verification before any dynamic load |
+| Side-channel attacks on ARM TrustZone via shared cache timing | 2027–2029 | Sensitive key material in Keystore/Secure Enclave increasingly targeted by cache-timing attacks on shared CPU resources | Use hardware-backed Keystore with `StrongBoxKeymaster`; avoid in-process key derivation for high-value secrets |
+
+---
+
+## §DETECTION-GAP
+
+What current mobile binary security monitoring CANNOT detect, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Frida/debugger attach post-ship**: Store review tooling and static SAST see no debuggable flag; a rooted device attaches Frida to the running process invisibly. Need: in-app RASP that calls `ptrace(PTRACE_TRACEME)` and checks `/proc/self/status TracerPid` at runtime; alert or terminate if non-zero.
+- **ProGuard rule drift over releases**: CI compares the current build but does not diff `proguard-rules.pro` changes across releases; a newly added `-keep` rule silently re-exposes a class. Need: git diff check on all ProGuard consumer rule files as part of release gate; fail build if any new `-keep class` rule covers a sensitive package.
+- **Repackaged APK distribution outside Play Store**: Legitimate store binary is clean; attacker strips, modifies, and redistributes via third-party APK sites. Standard monitoring sees only the canonical store listing. Need: enrol in Play Integrity API / Apple DeviceCheck; verify attestation token server-side on sensitive API calls to reject non-certified installs.
+- **Native library symbol exposure in stripped binaries**: `STRIP_INSTALLED_PRODUCT = YES` is set but the `dSYM` or unstripped `.so` is accidentally bundled in the app package rather than uploaded separately to Crashlytics/Sentry. Need: automated post-build check — `nm -U` on every `.so` / `otool -l` on every framework — assert symbol table is absent from the artifact submitted to the store.
+- **Cross-agent chain: static secret in binary + cloud endpoint without attestation**: Binary hardening agent finds a hardcoded endpoint URL (LOW finding); cloud specialist finds the same endpoint lacks Play Integrity verification (MEDIUM finding). Together: CRITICAL — attacker extracts URL from unobfuscated binary and calls endpoint from a tampered app. Need: CISO orchestrator Phase 1 synthesis step to correlate binary findings with cloud/API findings before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Debuggable Release Build", "filesReviewed": 3, "patterns": ["debuggable true", "isDebuggable = true"], "result": "CLEAN" },
+      { "class": "ProGuard Disabled", "filesReviewed": 5, "patterns": ["minifyEnabled false", "isMinifyEnabled = false"], "result": "CLEAN" },
+      { "class": "Hardcoded Secrets in Source", "filesReviewed": 142, "patterns": ["API_KEY", "SECRET", "password", "Bearer "], "result": "2 findings, both fixed" },
+      { "class": "Debug Symbols in Release Binary", "filesReviewed": 4, "patterns": ["STRIP_INSTALLED_PRODUCT", "debugSymbolLevel", "apktool output class names"], "result": "CLEAN" },
+      { "class": "allowBackup Enabled", "filesReviewed": 1, "patterns": ["allowBackup=\"true\""], "result": "CLEAN" }
+    ],
+    "filesReviewed": 155,
+    "negativeAssertions": [
+      "Debuggable release: searched build.gradle, AndroidManifest.xml — 0 matches",
+      "ProGuard disabled: searched all buildType configs — minifyEnabled is true in release"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/mobile-security-specialist/SKILL.md

@@ -122,3 +122,88 @@ If internet permitted:
 Write `.mcp/agent-runs/{agentRunId}/mobile-findings.json`
 Every finding maps to: MASVS control ID, MSTG test case ID, CWE, CVSSv4.
 Code fixes written directly in the affected mobile source files.
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Deep link / URL scheme parameter injection into WebView | Static scanners match URL handler registration, not downstream parameter consumption in WebView | Register a custom URL scheme; pass `javascript:` or `file://` as a parameter and confirm whether the embedded WebView evaluates it |
+| 2 | Keychain / Keystore item accessible after device unlock (kSecAttrAccessibleAlways) | Scanners flag string literals but miss the accessibility constant in programmatic API calls | Dump Keychain entries using `objection` or `frida-ios-dump`; confirm kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly or stricter is set for every sensitive item |
+| 3 | Certificate pinning bypass via dynamic pin update over HTTP | Scanner sees pinning code present and marks it clean; misses the pin being fetched from an unauthenticated endpoint | Intercept the pin-update call with a MITM proxy; substitute an attacker-controlled certificate fingerprint |
+| 4 | Second-order deserialization in push notification / silent push payload | Scanner checks incoming payload parsing but not deferred execution after background wake | Send a crafted APNs / FCM silent push payload with a nested serialized object; verify the deserialization code path handles malformed data without code execution |
+| 5 | Race condition in biometric + crypto object creation (TOCTOU on Android BiometricPrompt) | Sequential scanners model one authentication flow; concurrent requests to the same CryptoObject are not tested | Spawn two simultaneous authentication attempts sharing the same `CryptoObject` instance; confirm only one succeeds and no crash / bypass occurs |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later: RSA/ECDSA keys protecting long-lived mobile session tokens or stored health data signed today will be decryptable | Inventory all RSA/ECDSA key usage in mobile crypto stack; migrate long-lived secrets to ML-KEM (FIPS 203) and hybrid TLS; begin with Secure Enclave / StrongBox key rotation plan |
+| AI-powered binary analysis (LLM-assisted reversing) | 2025–2027 (active) | Automated reverse engineering using GPT-4/Claude-level models identifies obfuscated logic, hardcoded secrets, and anti-tamper bypass paths in minutes, not days | Assume every binary will be fully deobfuscated; remove all secret material from binaries entirely; enforce hardware-backed key storage with no software fallback |
+| SIM-swap / eSIM hijack escalation | 2025–2026 (active) | GSMA eSIM transfer APIs (CVE-2023-38185 class) allow carrier-assisted SIM swap without physical store; any SMS OTP auth is now trivially bypassed for targeted users | Migrate all security-sensitive authentication from SMS OTP to TOTP or FIDO2 passkeys; treat phone number as identifier only, never as authenticator |
+| Malicious SDK update via compromised package registry | 2025–2026 (active) | Supply-chain attack on CocoaPods (CVE-2024-38368), npm packages used by React Native, or Maven Central compromises millions of apps silently | Pin SDK versions with hash verification; adopt SLSA L2 for mobile build pipeline; subscribe to vendor security advisories for every third-party SDK |
+| EU CRA / US EO 14028 mandatory SBOM enforcement | 2025–2026 (active) | Mobile apps shipping to EU markets must provide SBOM and demonstrate software supply chain provenance; non-compliant apps face market withdrawal | Generate CycloneDX SBOM per mobile release build; achieve SLSA L2 minimum; document all SDK provenance |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Silent data exfiltration via third-party SDK analytics:** The SDK call looks like telemetry; no anomaly in network logs because the SDK domain is allowlisted. Need: per-SDK network traffic volume baseline; alert when any single SDK domain receives more than 3× its 30-day data volume baseline within a session.
+- **Jailbreak / root detection bypass at runtime:** Frida/Objection hooks are injected post-launch; device integrity checks pass at startup and never re-run. Need: periodic re-attestation using Apple DeviceCheck / Android Play Integrity API throughout the session, not only at login.
+- **Keychain item exfiltration on jailbroken device:** No log event emitted; attacker reads Keychain directly from SQLite on device. Need: server-side anomaly detection — flag authentication tokens used from a new device fingerprint without re-authentication.
+- **OTA code injection via compromised Expo / CodePush update:** Update download looks legitimate; only difference is the bundle hash. Need: enforce code signing verification (EAS Code Signing / CodePush code signing) and log bundle hash on every update; alert on hash mismatch or unexpected update outside release window.
+- **Cross-agent attack chains:** A weak certificate pin (mobile finding) + an SSRF endpoint (cloud finding) = a full MITM-to-IMDS chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "Insecure Keychain/Keystore Storage", "filesReviewed": 23, "patterns": ["kSecAttrAccessible", "KeyStore.getInstance"], "result": "CLEAN" }],
+    "filesReviewed": 23,
+    "negativeAssertions": ["Insecure storage: kSecAttrAccessibleAlways pattern searched across 23 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```