firebase-apk-scanner

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting API_KEY/PROJECT_ID from APKs and inserting them into curl commands and report outputs, which requires the LLM to handle and potentially emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow decompiles and extracts Firebase configuration from the user-provided APK(s) (Step 2: “Decompile the APK… Extract Firebase configuration… from … assets, smali code, DEX strings”), and that APK content is outsider-authored free text if the operating user did not author the app, which then becomes LLM-readable evidence/reports via the scanner’s generated text/JSON.