claude-app-tester

i gave claude code a rooted android phone. in one session it autonomously reverse-engineered subway surfers, hooked the coin logic, bypassed the anti-cheat, and gave itself unlimited coins. full write-up on x: https://x.com/skshadan_/status/2042232847759737264

a claude code plugin for pentesting android apps on a rooted device. it gives the agent hands on a phone: it reads the screen, taps and types, intercepts traffic, decompiles the apk, and works through an app looking for vulnerabilities while you watch.

the agent drives a tight loop. it dumps the current screen into a numbered list of interactive elements, picks one action, performs it over adb, reads the network traffic that action produced, and decides what to do next. repeat until the app has been exercised.

requirements

these are runtime dependencies you install yourself. the plugin orchestrates them, it does not bundle them.

• a rooted android device or emulator. for an emulator, magisk via rootAVD works well.
• adb connected to the device (adb devices should list it).
• mitmproxy for traffic interception.
• frida for ssl pinning and root-detection bypass.
• python 3.10 or newer.

installing the plugin

the plugin lives in this repository. pick the method that matches how you want to use it.

try it locally

point claude code at the plugin directory for the current session:

claude --plugin-dir /path/to/claude-android

then invoke the skill:

/claude-app-tester:app-tester

after editing any plugin file, run /reload-plugins to pick up the changes without restarting.

load it in every session

because the repository ships a .claude-plugin/plugin.json, copying it into your skills directory makes claude code load it automatically on every launch as claude-app-tester@skills-dir:

cp -r /path/to/claude-android ~/.claude/skills/claude-app-tester

if you place it under a project's .claude/skills/ instead, accept the workspace trust prompt the first time.

install from a marketplace

this repository ships a .claude-plugin/marketplace.json, so others can add it and install in two steps:

/plugin marketplace add skshadan/claude-android-reverse
/plugin install claude-app-tester@skshadan

or run /plugin to browse and install interactively.

usage

tell the agent what to test, and give it credentials if a login is involved:

Test com.example.app. creds: user@example.com / password123

from there the agent sets up the proxy, launches the app, signs in, intercepts traffic, and hunts for issues on its own. you can steer it at any point.

how it works

the agent runs four steps in a cycle:

1. observe. scripts/ui.py parses the ui hierarchy into a compact, numbered list of the elements you can actually interact with.
2. act. one action per cycle over adb: tap, type, scroll, or a key event.
3. intercept. scripts/traffic.py shows the requests that the last action produced.
4. decide. the agent reads what changed and picks the next action.

static analysis runs alongside the loop. a reverse-engineering sub-agent pulls the apk, decompiles it with apktool, and reports exported components, deeplink schemes, api endpoints, hardcoded secrets, and anti-patterns. those findings feed targeted testing back in the loop.

after the main flows are exercised, scripts/analyze.py reviews the captured traffic for idors, broken auth, data exposure, and missing security headers.

what is included

path	purpose
skills/app-tester/SKILL.md	the skill itself: setup, the loop, adb reference, teardown, rules.
scripts/ui.py	parses the ui hierarchy into numbered interactive elements with spatial dedup.
scripts/capture.py	mitmproxy addon that logs http flows to jsonl. set PRESERVE_AUTH=1 to keep auth headers.
scripts/traffic.py	summarizes recent traffic by time window, with optional headers and bodies.
scripts/analyze.py	security analyzer. modes: endpoints, idor, auth, exposure, headers, full.
scripts/bypass.js	frida ssl pinning bypass covering TrustManagerImpl, OkHttp3, SSLContext, and Conscrypt.
references/frida.md	frida setup, codeshare scripts, and hooking patterns.
references/testing-methodology.md	what to do with each finding type.
references/agents/reverse-agent.md	the apk decompilation sub-agent.

a note on scope

this is for testing apps you own or are explicitly authorized to test. the proxy setting it applies persists across reboots, so let the agent run its teardown step when you are done, or clear it yourself with adb shell settings delete global http_proxy.

license

mit