The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically Android (APK) and iOS (IPA) application files and their decompiled source code.
Ingestion points: The scripts/apk_analyzer.py script reads binary manifests, resource files, and decompiled Java/Kotlin source code (e.g., in scan_secrets and analyze functions).
Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded commands within the data extracted from the analyzed applications.
Capability inventory: The skill facilitates file system reading, writing of report files, and provides instructions for executing various shell commands (apktool, jadx, frida, objection).
Sanitization: The analysis script performs basic truncation of discovered secrets to 80 characters, but does not perform comprehensive sanitization of all ingested strings before they are presented to the agent's context.
[COMMAND_EXECUTION]: The skill documentation and example usage files (SKILL.md, examples/example_usage.md) provide numerous shell commands for mobile application reverse engineering and dynamic instrumentation. These instructions guide the agent to perform actions such as decompiling binaries, identifying packers, and performing runtime hooking.
[EXTERNAL_DOWNLOADS]: The skill references several well-known security tools and frameworks, including Frida, objection, and MobSF. These are industry-standard resources used for legitimate security research and are documented neutrally within the skill's references.

Mobile Application Security