jamboree-android-security-testing
Warn
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones an external, non-vendor repository from
https://github.com/hero-mike/Android-Mobile-Security-Sandbox-Testing.gitto obtain orchestration scripts and Magisk modules. - [REMOTE_CODE_EXECUTION]: The skill executes unverified shell scripts downloaded from the external repository, including
./orchestration/deployers/install-all.sh,./modules/magisk/systemless/install-magisk.sh, and./modules/burp/certificates/install-burp-cert.sh. - [COMMAND_EXECUTION]: The skill performs high-privilege operations on the connected Android device or emulator:
- Executes
adb rootandadb remountto gain write access to the system partition. - Modifies the system certificate store at
/system/etc/security/cacerts/to install interception certificates. - Changes global system settings using
adb shell settings put global http_proxyto redirect device traffic through an external proxy (Burp Suite).
Audit Metadata