android-app-pentest-environment

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This guide is a high-risk dual‑use toolkit: it explicitly instructs how to install Magisk and system modifications, inject system CA certificates and perform SSL unpinning, hide root (MagiskHide/Shamiko), run Frida server (remote instrumentation), and use proxy interception — all of which enable credential interception, remote code execution/control, and stealthy persistent access if misused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains explicit runtime commands that fetch and execute remote code (e.g., git clone https://gitlab.com/newbit/rootAVD.git then running ./rootAVD.sh, curl -L -o Magisk.zip https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk, and curl -L -o frida-server https://github.com/frida/frida/releases/download/16.5.9/frida-server-16.5.9-android-arm64.xz), so those external URLs are used at runtime to obtain and run required tooling.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs rooting emulators (Magisk/rootAVD), remounting and modifying system partitions and ramdisk, altering build.prop, installing system CA certificates, and installing SSL-unpinning / hiding modules and Frida scripts to bypass app security—i.e., it directs active modification of system state and bypassing security mechanisms.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)