The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several command-line tools for Android application analysis and modification. Evidence includes the use of jadx for decompilation, apktool for unpacking and rebuilding smali code, adb for device interaction and package installation, and apksigner for binary signing. These operations are performed as part of the intended reverse engineering workflow.
[DYNAMIC_EXECUTION]: The skill relies on the Frida instrumentation framework to inject and execute custom JavaScript code into running Android application processes. This allows for runtime monitoring and modification of application behavior, such as intercepting cryptographic operations, capturing network traffic, and bypassing environment checks (root/emulator detection). Example scripts are provided in cheatsheet.md for these purposes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes externally-sourced, untrusted APK files.
Ingestion points: Android APK files and their extracted components (DEX files, AndroidManifest.xml, resources) are the primary inputs processed by the agent using this skill.
Boundary markers: The instructions reference authorized scope documentation (tradecraft-scope-roe, scope.txt) to define operational limits.
Capability inventory: The skill uses high-privilege tools including adb (with su capabilities), apktool, and frida to execute shell commands and runtime scripts across SKILL.md and cheatsheet.md.
Sanitization: The "Gotchas" section in SKILL.md includes a warning for identifying malicious samples and advises recording indicators rather than performing destructive actions.

mobile-apk-reverse