smali-dex-patching

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is an openly advertised authorized-pentest guide for patching APKs, but its "builder perspective" DEX-module host and "reported APK-agent" anti-tamper notes describe a covert operator-telemetry and remote-module design, which hides activity from the user, so it is sketchy rather than clearly malicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow decompiles a user-supplied APK with apktool and greps and reads its smali, strings, and resources, so a third-party or malicious app author could embed injected text there, but the attacker must get the APK to the user and cannot force delivery.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The only inbound repository locator the skill instructs the user to act on is the personal github.com/ax/apk.sh repository, whose code is run for split-APK pull/patch/build, so it is an unofficial individual-owned dependency and rates medium.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.35). The skill teaches patching APKs to bypass root detection, SSL pinning, and license checks, which is offensive, but it operates on a target app rather than on the agent's own machine, and it does not ask for sudo, system file edits, user creation, or service/SSH config changes.