Instruments running processes with Frida hook scripts to capture runtime API events.
npx skills add https://github.com/gadievron/raptor --skill frida
Please help me install this Agent Skill. Skill: frida Source: https://github.com/gadievron/raptor/tree/main/.claude/skills/frida Command: npx skills add https://github.com/gadievron/raptor --skill frida
Static analysis can flag dangerous sinks in a binary or mobile app, but it cannot prove they actually execute at runtime. This Skill attaches Frida to a target process, loads hook scripts, and captures send() events into a managed run directory so you can confirm sinks fire, trace API calls, bypass SSL pinning, and harvest fuzzing seeds.
Ask the assistant to trace API calls in a target binary for 60 seconds using the frida api-trace template and summarize the captured events.
High-intent search queries and answers about installing and using this skill.
Run the api-trace template against a target PID, process name, or binary path with a duration limit. The runner hooks functions like open, read, write, connect, and execve, then writes one JSON object per event to events.jsonl in the run directory.
Use the ssl-unpin template with the app's bundle id, the --usb flag, and --spawn mode. It hooks iOS/macOS Security.framework and OpenSSL verification paths; Android X509TrustManager hooks need the Java bridge, which is unbundled on Frida 17.
Yes, pass --host with the target address to connect to a remote frida-server. Note that most frida-server binaries bind to 127.0.0.1 by default, so start it with -l 0.0.0.0:27042 or SSH-forward port 27042.
On Linux, ptrace denied means kernel.yama.ptrace_scope is 1 or higher; lower it or use spawn-and-attach. On macOS, task_for_pid failures indicate hardened-runtime or system processes requiring SIP disabled or a get-task-allow entitlement.
Sink, exec, and load events only count as evidence when the target binary is on the call stack in spawn mode. Seed-harvest and jni-trace runs produce no runtime evidence, and --unsafe-attach bypasses the sandbox entirely, which is logged in metadata.json.
openaiTrace security findings from source to sink and calibrate severity against a threat model.
balic-AI-ML-R-D-ResourcesFuzz Python code and C extensions with coverage-guided Atheris.
jassicsAutomate MASTG-based mobile penetration tests on Android and iOS apps.
philo-grovesIntegrate debuggers, instrumentation, and crash replay for binary dynamic analysis.
