jamboree-android-security-testing

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The URLs are not overtly malicious system installers (no direct .exe/.msi links) but the GitHub repo is from an unverified/unknown user and the project includes scripts that perform privileged actions (Magisk installation, root-modification, system CA installation, pushing/running Frida) which can be abused—ara.so is an unverified short domain and example.com is a placeholder—so treat these sources as suspicious/untrusted until verified.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill package contains multiple explicit offensive capabilities (system CA install for TLS MITM, TrustManager/SSL pinning bypasses, Frida/Objection runtime hooks that log/intercept cryptographic inputs/outputs and network calls, explicit key extraction to disk, database/shared-preferences/memory dumping, and scripts that require root/remount and install Magisk/frida-server) that are clearly intended to capture and exfiltrate sensitive credentials/data and to enable remote runtime code manipulation—features that can be deliberately abused for credential theft, data exfiltration, and system compromise.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill directs users to git clone and then run orchestration scripts from https://github.com/hero-mike/Android-Mobile-Security-Sandbox-Testing.git (git clone ... then ./orchestration/deployers/install-all.sh), which fetches remote code that is executed at runtime and is a required dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs obtaining root (adb root, su), installing Magisk, remounting and writing to /system (installing CA certs, Magisk modules, modifying system/adb files), and creating persistent privileged hooks — actions that modify the machine/device state and require elevated privileges.