The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external security tools including adb for device interaction, apktool for APK decompilation, and strings for binary analysis. These commands are constructed using list arguments, which prevents shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted mobile application binaries and configuration files.
Ingestion points: The extract_strings_from_apk function in scripts/agent.py reads data from APK binaries, and check_android_manifest reads AndroidManifest.xml files.
Boundary markers: None identified; external content is processed directly.
Capability inventory: The skill can execute shell commands via subprocess.run and perform network requests via the requests library.
Sanitization: None; the script performs basic string matching and regex analysis without escaping output for further instruction processing.
[SAFE]: The script disables SSL verification specifically for testing certificate pinning and intercepting traffic with a proxy, which is a standard procedure in mobile penetration testing.

conducting-mobile-app-penetration-test