What problem does it solve? Mobile recon often stalls when you cannot obtain an IPA or APK, yet two public, unauthenticated JSON files on the target's domain already declare which apps handle its URLs and which paths they claim. This Skill turns those declarations into concrete attack surface while preventing the common false positive of reporting staging-app link hijacking that certificate binding actually prevents. ## Core Features & Use Cases - Declaration harvesting: Fetch apple-app-site-association and assetlinks.json (including the legacy non-.well-known path) across candidate hosts to enumerate production, staging, and internal bundle identifiers. - Path mining: Extract the exact claimed URL paths (e.g., /payment/, /account-linking/) as a curated list of sensitive token-bearing flows for web testing. - Exploitability verification: Compare Android sha256 cert fingerprints and iOS team IDs to decide whether a staging declaration is genuinely reportable or a hygiene note. - Use Case: During a fintech engagement with no IPA access, pull the AASA file from the production domain, recover staging bundle IDs and claimed payment paths, then verify fingerprint separation before writing anything into the report. ## Quick Start Fetch the .well-known/apple-app-site-association and assetlinks.json files from the target domain and analyze them for staging app identifiers and claimed URL paths.
