Skills
skills/aradotso/security-skills/jamboree-android-security-sandbox/Gen Agent Trust Hub

jamboree-android-security-sandbox

Fail

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill clones a repository from an untrusted source (hero-mike/Android-Mobile-Security-Sandbox-Testing) and executes several shell scripts found within it during the setup phase, including deploy-magisk.sh, setup-burp-proxy.sh, and install-objection.sh.
  • [EXTERNAL_DOWNLOADS]: Fetches external binaries and modules, including the Frida server from GitHub releases and various Magisk modules such as busybox.zip and ssl-unpinning.zip from local paths intended to be populated from the external repository.
  • [COMMAND_EXECUTION]: Performs extensive high-privilege operations on connected Android devices, such as enabling root access (adb root), remounting system partitions (adb remount), and modifying system certificate stores and build properties (build.prop).
  • [COMMAND_EXECUTION]: The provided automation scripts discover-apis.sh and extract-databases.sh interpolate user-provided package names directly into shell commands (e.g., adb shell "run-as ${PACKAGE} ...") without sanitization or boundary markers. This creates a vulnerability surface where a malicious package name could execute arbitrary commands with the capabilities of the adb shell.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 1, 2026, 09:18 PM
Security Audit — agent-trust-hub — jamboree-android-security-sandbox