performing-dynamic-analysis-of-android-app

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs dumping decrypted data and secrets (keystore dump, heap/memory searches, printing cipher inputs/outputs and API/password strings), which requires reading and emitting secret values verbatim during analysis.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High-risk dual-use content: although framed for authorized testing, the guide contains explicit, actionable instructions to run a persistent Frida server, bypass root/SafetyNet checks, hook crypto/networking, dump Android Keystore and search memory for "password"/"api_key" — all clear patterns that enable credential theft, data exfiltration, and remote code manipulation and thus are easily abused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs downloading and running the Frida server from https://github.com/frida/frida/releases at setup time — a required runtime fetch whose binary is executed on the device, so remote code directly controls execution.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing and running Frida on a (rooted) device, modifying app/runtime behavior to bypass root detection and SafetyNet, and extracting keystore/secrets—actions that bypass security mechanisms and alter the target device/process state.