What problem does it solve? Mobile applications expose attack surfaces through WebViews, deep links, and JavaScript bridges that are easy to misjudge: a scheme that merely opens an app is not a vulnerability, and noisy probing wastes time or trips defenses. This Skill provides an evidence-gated, authorization-first workflow for testing the security boundary between web content and native mobile components without false positives or out-of-scope actions. ## Core Features & Use Cases - Trigger-based routing: Activates on signals like mobile_deep_link, webview_bridge, javascript_interface, Cordova/React Native markers, and mobile API endpoints discovered during assessment. - Evidence-gated validation: Enforces a fixed cadence of baseline, single-variable probe, post-baseline, oracle, and evidence collection, treating WAF blocks, captchas, and timeouts as inconclusive rather than findings. - Clear oracle and stop rules: Confirms findings only when an unintended origin, URL, or parameter triggers a protected bridge or cross-app data boundary with device log proof, and halts on real user data, third-party apps, or unknown APKs. - Use Case: During an authorized assessment of your own Android app, a web page contains a javascript_interface marker. Use this Skill to plan a safe validation path with your own APK and emulator, comparing scheme, origin, and parameter handling on a no-op bridge action before escalating to native reverse engineering. ## Quick Start Use $hunt-mobile-bridge to plan an evidence-gated, authorized validation path for the WebView bridge and deep link surface of my test APK.
