Mobile Security Engineer

Download SKILL.mdGet Murage How skills work

Open source. macOS, Windows and Linux.

At a glance

What it is

Mobile application security covering certificate pinning implementation, secure local storage patterns, jailbreak and root detection, code obfuscation and tamper detection, API security for mobile clients, biometric authentication, secure key management, network security, reverse engineering defense, and compliance with OWASP MASVS.

A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.

File: SKILL.md
Length: 552 lines1,885 words, about 9 min read
Category: Software engineeringmobile development
Level: Intermediate
License

More software engineering skills.

The full skill.

The whole file, exactly as it downloads. Read it before you rely on it.

SKILL.md

552 lines · 1,885 words

Download

Mobile Security Engineer

Overview

Mobile security engineering protects applications from reverse engineering, data theft, man-in-the-middle attacks, and runtime tampering. Mobile apps operate in hostile environments where attackers have physical device access, can decompile code, intercept network traffic, and modify app behavior at runtime. This skill covers defense-in-depth strategies aligned with OWASP Mobile Application Security Verification Standard (MASVS).

OWASP MASVS Security Levels

Put this skill to work.

Questions.

What is the Mobile Security Engineer skill?

How much does it cost?

Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.

Can I change it?

Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.

Give your first job to Murage.

Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.

Download Murage

No account needed · Runs on the AI plan you already pay for

class DeviceIntegrityChecker { fun isDeviceCompromised(): Boolean { return isRooted() || isEmulator() || isDebuggerAttached() || isHooked() } private fun isRooted(): Boolean { val checks = listOf( ::checkRootManagementApps, ::checkSuBinary, ::checkDangerousProps, ::checkRWSystem, ::checkMagisk, ) return checks.any { it() } } private fun checkRootManagementApps(): Boolean { val rootApps = listOf( "com.topjohnwu.magisk", "eu.chainfire.supersu", "com.koushikdutta.superuser", ) return rootApps.any { isPackageInstalled(it) } } private fun checkSuBinary(): Boolean { val paths = listOf( "/system/bin/su", "/system/xbin/su", "/sbin/su", "/data/local/su", "/data/local/bin/su", "/data/local/xbin/su", ) return paths.any { File(it).exists() } } private fun checkMagisk(): Boolean { // Magisk hides itself, check for signs using ProcessBuilder return try { val process = ProcessBuilder("which", "magisk") .redirectErrorStream(true) .start() process.waitFor() == 0 } catch (e: Exception) { false } } private fun isEmulator(): Boolean { return (Build.FINGERPRINT.contains("generic") || Build.MODEL.contains("Emulator") || Build.MODEL.contains("Android SDK built for x86") || Build.HARDWARE.contains("goldfish") || Build.HARDWARE.contains("ranchu") || Build.PRODUCT.contains("sdk_gphone")) } private fun isDebuggerAttached(): Boolean { return android.os.Debug.isDebuggerConnected() || android.os.Debug.waitingForDebugger() } private fun isHooked(): Boolean { // Check for Frida (common hooking framework) return try { // Frida typically listens on port 27042 val socket = java.net.Socket() socket.connect(java.net.InetSocketAddress("127.0.0.1", 27042), 1000) socket.close() true // Connection succeeded = Frida detected } catch (e: Exception) { false } } }

Mobile Security Engineer

More software engineering skills.

The full skill.

Mobile Security Engineer

Overview

OWASP MASVS Security Levels

Put this skill to work.

Questions.

Give your first job to Murage.

Search murage.ai

Mobile Security Engineer

More software engineering skills.

The full skill.

Mobile Security Engineer

Overview

OWASP MASVS Security Levels

Put this skill to work.

Questions.

Give your first job to Murage.

Create a bot and use this skill.

Ask Ember to create the bot

Open the bot’s skills

Find Mobile Security Engineer and switch it on

Ask the bot for the job

About this skill.

Certificate Pinning

iOS Certificate Pinning

Android Certificate Pinning

Certificate Pinning Best Practices

Secure Storage

iOS Keychain

Android Encrypted Storage

Jailbreak and Root Detection

Multi-Layer Detection

Response Strategies for Compromised Devices

API Security for Mobile

Secure API Communication Pattern

API Security Checklist

Biometric Authentication

iOS Face ID / Touch ID

Security Testing Checklist (MASVS Aligned)

When to Use

Output Format

Example

Edge Cases