competition-crypto-mobile
Helps your agent analyze security challenges in mobile apps. It can decode information, inspect hidden data, and understand how apps handle security.
What it does
This tool helps solve security challenges in mobile apps, like uncovering secrets in code, recovering lost information, or understanding how apps communicate securely.
When to use it
- ✓When you need to decipher a secret code or message.
- ✓When you want to find hidden information within a mobile app.
- ✓When you need to understand how an app signs or secures its communications.
Example of what to ask your AI
“Help me uncover what's hidden in this mobile app file.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool works by analyzing the app step-by-step, looking for different types of codes, hidden data, or security mechanisms. It tries to reconstruct the original information in an organized way.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill competition-crypto-mobileOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/CTF-Sandbox-Orchestrator/competition-crypto-mobile/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Competition Crypto Mobile
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the active challenge depends on recovering a transform chain, hidden media payload, mobile signing path, or local trust boundary.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Decide whether the dominant path is crypto, stego, or mobile.
- Recover transforms in order; do not jump straight to the fanciest algorithm.
- Record exact parameters and boundaries that affect the result.
- Hook the narrowest mobile boundary that proves the behavior.
- Reproduce the plaintext, payload, signed request, or accepted branch.
Workflow
1. Crypto And Encoding
- Reconstruct the chain step by step: container, compression, encoding, xor or substitution, crypto, integrity, final parse.
- Keep exact keys, IVs, nonces, salts, tags, offsets, and byte order.
2. Stego
- Inspect metadata, chunk layout, palettes, alpha planes, LSBs, thumbnails, trailers, and transcoding artifacts.
- Rank decode attempts by evidence, not by brute-force curiosity.
3. Mobile
- Start with manifest or plist, exported components, deeplinks, native libs, shared prefs, local DBs, and configs.
- Trace signer logic, token storage, SSL pinning, protobuf or RPC boundaries, and native bridge calls.
Read This Reference
- Load
references/crypto-mobile.mdfor the transform checklist, hook targets, and evidence packaging. - If the task is specifically about Android dynamic tracing, signer hooks, JNI boundaries, or pinning checks, prefer
$competition-android-hooking. - If the task is specifically about iOS runtime tracing, Keychain access, Objective-C or Swift hooks, or pinning checks inside an IPA, prefer
$competition-ios-runtime. - If the task is specifically about media carriers, hidden channels, thumbnails, or appended trailers, prefer
$competition-stego-media.
What To Preserve
- Decisive bytes proving each decode stage
- Hook points, signed strings, headers, and local storage paths
- Component names, protobuf fields, channel-specific outputs, or trailer offsets
FAQ
What is a 'transform chain'?
It's a sequence of steps (like encryption, encoding, or compression) that were applied to information to hide or protect it.
What does 'hook an APK or IPA signer' mean?
It means intercepting or observing how an app (APK for Android, IPA for iOS) signs its actions or communications, to understand the security process.
Why is it important to record exact parameters?
Because in security challenges, even a small detail like an encryption key or the order of steps can completely change the outcome.
Details
Original description by the author
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for crypto, encoding, steganography, APK, IPA, and mobile trust-boundary challenges. Use when the user asks to decode a blob, recover a transform chain or key, inspect hidden media payloads, hook an APK or IPA signer, inspect app storage, or replay mobile request-signing logic. Use only after `$ctf-sandbox-orchestrator` h
Popularity
- GitHub stars
- 42k
- Ranking position
- #4711
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC