android-studio-pentest-environment

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains multiple deliberate high-risk behaviors — explicit credential-stealing Frida hooks, instructions to install/root Magisk and run a persistent, root-level Frida server (a remote instrumentation/backdoor capability), SSL‑pinning bypasses and system CA injection for transparent TLS interception, and guidance to disable/hide security controls — all of which enable unauthorized data exfiltration and persistent remote code execution.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clones and executes code from external repositories and downloads binaries at runtime—e.g., git clone https://gitlab.com/newbit/rootAVD.git followed by running ./rootAVD.sh, curl/wget of https://github.com/topjohnwu/Magisk/releases/download/v28.1/Magisk-v28.1.apk and https://github.com/frida/frida/releases/download/$FRIDA_VERSION/frida-server-$FRIDA_VERSION-android-arm64.xz—which are fetched during runtime, executed/pushed to the device, and required for the skill to operate.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs obtaining root, remounting and replacing system ramdisks, pushing files into /system, installing system CA certs, running su commands and creating persistent root services—actions that modify system images and bypass security controls—so it clearly pushes the agent to change/compromise the machine state.