The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted binary artifacts (APKs, IPAs, Android backups). It encourages the use of multimodal LLMs to analyze images found within these backups. This establishes an indirect prompt injection surface where malicious instructions could be embedded in strings, metadata, or images within the analyzed files to manipulate the agent's behavior. 1) Ingestion points: target.apk, backup.ab, target.ipa, and extracted images/databases; 2) Boundary markers: No specific delimiters or instructions are provided to the agent to treat data from these artifacts as untrusted or to ignore embedded instructions; 3) Capability inventory: The skill utilizes shell execution for tools like strings, grep, unzip, tar, and curl, alongside dynamic Python script execution and Frida instrumentation; 4) Sanitization: There is no evidence of sanitization or safety-filtering for the content extracted from the mobile artifacts before it is processed by the agent.
[COMMAND_EXECUTION]: The workflow relies heavily on executing shell commands and Python snippets to perform forensic tasks, such as manual zlib decompression of Android backup headers and searching for cryptographic keys in decompiled code. While these are necessary for the skill's purpose, they represent a broad execution capability.
[EXTERNAL_DOWNLOADS]: The skill references and provides instructions for downloading several external tools and repositories, such as Il2CppDumper and blutter from GitHub. These are well-known tools in the security community but constitute a dependency on external, unversioned code during the setup or execution phase.

mobile-ctf