android-apk-patch

High-risk but not malware. The skill is internally coherent as an APK patching guide, yet its actual footprint is powerful and offensive-leaning: it teaches bypasses for SSL pinning, root detection, signature checks, and integrity controls, and it installs/runs privileged tooling and community scripts. Data exfiltration is not evident, but the combination of root/container access, third-party installers, and app-tampering guidance makes this unsuitable as a low-risk general agent skill.

The supplied content is documentation for running a privileged, root-capable Android container and testing APKs. It contains no direct evidence of malicious code or intentional data theft. However, publishing ADB on port 5555, using --privileged, mounting /dev/dri, executing an unpinned GitHub script with sudo, and using mutable latest image tags create substantial security and supply-chain risks. Restrict ADB to localhost or firewall it, pin and verify images and scripts, avoid unnecessary privileges and device mounts, and use secure secret handling.

The fragment is not itself a malware payload and contains no direct data theft or system-damaging behavior. It does provide explicit instructions and examples for bypassing application integrity checks, Play Integrity, and system protections, creating a meaningful misuse and tampering risk. The content is dual-use reverse-engineering material, with risk arising from the capabilities it enables rather than from autonomous malicious execution in the shown text.