flutter-api-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands via
adbto manage the Frida server on an Android device, including the use ofchmodfor permission modification and process monitoring. - [CREDENTIALS_UNSAFE]: Guides the user in identifying and extracting sensitive authentication information, such as JWT tokens and session credentials, from local storage files like
shared_prefsand from the application's runtime memory. - [DATA_EXFILTRATION]: Details technical methods for intercepting and reading plaintext HTTPS traffic by hooking low-level SSL functions (
ssl_write_chain_func) inlibflutter.so, allowing access to data before it is encrypted for network transmission. - [EXTERNAL_DOWNLOADS]: Recommends the installation of several external security tools including
frida,frida-tools,jadx, andblutterto perform application analysis. - [COMMAND_EXECUTION]: Employs dynamic instrumentation via the Frida framework to inject and execute custom JavaScript code within running mobile application processes to hook native library functions.
Audit Metadata