skills.rest
DCx7C5
DCx7C5COMMUNITY
Explore all skills by this author →
GitHub

insecure-SKILL.md

Scan Android and iOS apps for insecure local data storage vulnerabilities.

Updated Apr 20, 2026
Search Tags:#ios#android#pentest#keystore#data-storage#mobile-security#insecure-storage
One-click install
npx skills add https://github.com/DCx7C5/ai-marketplace --skill insecure-skill-md
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-SKILL.md
Source: https://github.com/DCx7C5/ai-marketplace/tree/main/skills/mobile/insecure
Command: npx skills add https://github.com/DCx7C5/ai-marketplace --skill insecure-skill-md

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Android and iOS apps often store sensitive data in insecure local storage, risking credential leakage, data exposure, and non-compliant backups.

Core Features & Use Cases

  • Android SharedPreferences analysis: Detect plaintext credentials and tokens stored in XML files.
  • SQLite/Plist inspection: Identify unencrypted databases and misconfigured storage.
  • Compliance and remediation: Surface findings to guide secure storage upgrades (e.g., SQLCipher, Keychain services).
  • Use Case: A pentest discovers that an app stores API keys in SharedPreferences and backs up unencrypted data, triggering remediation.

Quick Start

Run this skill against a target mobile app to scan for insecure local data storage patterns and surface actionable findings.

Frequently Asked Questions about insecure-SKILL.md

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan an Android app for plaintext credentials in SharedPreferences?▼

Identifying insecure data storage detects unencrypted SQLite databases during mobile pentest by inspecting database formats and storage locations. It surfaces data leakage risks and improper backup configurations to guide remediation using encrypted alternatives like SQLCipher.

What is the best way to detect insecure iOS keychain and plist storage?▼

Detecting insecure iOS keychain and plist storage involves inspecting misused keychains and misconfigured local data formats. This surfaces improper backup and data exposure risks, providing actionable findings for compliance assessments and secure storage remediation.

Can I use this approach for both Android and iOS compliance assessments?▼

Yes, insecure data storage scanning applies to both Android and iOS compliance assessments by inspecting storage locations, permissions, and data formats across both platforms. It detects data leakage, plaintext credentials, and improper backups to satisfy compliance requirements.

How to inspect mobile app local storage for data leakage during pentest?▼

Inspecting mobile app local storage for data leakage during pentest involves scanning for plaintext credentials, unencrypted databases, and misused keychains. It analyzes storage locations and permissions to surface actionable findings for improper backup remediation.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

exploiting-insecure-data-storage-in-mobile

Identify and exploit insecure data storage vulnerabilities in Android and iOS mobile applications.

Official
Advanced
martinholovskymartinholovsky
45

SQLCipher Encrypted Database Expert

Implement SQLCipher encrypted SQLite databases with Argon2id key derivation and OS keychain storage.

Community
Advanced
DCx7C5DCx7C5

pentest-SKILL.md

Identify and exploit security weaknesses in iOS and Android apps via OWASP MASTG.

Community
Advanced
utsavthakurutsavthakur

ios-pentesting-tricks

Extract keychain data and analyze iOS binary protections for authorized security assessments.

Community
Advanced