kernel-audit-security

SUSPICIOUS: the visible top-level skill is internally consistent as a security-audit/pen-test orchestrator and shows no direct credential theft, exfiltration, or installer abuse. However, it grants offensive security capabilities to an AI agent and relies on many unprovided local subskills, so the main risk is transitive and operational rather than confirmed malicious behavior.

The supplied code demonstrates severe Android access-control and credential-handling vulnerabilities: exported components expose password data, bypass authentication, permit password changes, and disclose decrypted passwords through SMS and logs. These are high-impact security risks. The content is readable and instructional, with no meaningful obfuscation or evidence of conventional malware such as a hidden backdoor, cryptominer, or unrelated exfiltration mechanism; however, the demonstrated receiver intentionally performs unauthorized credential disclosure when invoked.

This is an exploit demonstration rather than ordinary application functionality. It shows intent hijacking and attacker-controlled ContentProvider behavior that can lead to path traversal and arbitrary native library execution when a victim application inadequately validates implicit-intent results and loads content:// or file:// resources. The fragment itself does not show execution against a victim, but the example components are intentionally malicious in their described deployment context.

This skill is coherent with its stated purpose, but that purpose is itself high risk: it equips an AI agent to perform offensive security review, dynamic testing, and exploit discovery on target code. No direct credential theft, exfiltration endpoint, or suspicious installer appears in the excerpt, so it is not malware; however, it should be treated as a high-risk security tool because it combines untrusted code processing with execution-oriented auditing workflows.

The fragment documents a WebView bridge exploitation technique that can retrieve and display a secret from a vulnerable iOS application. It presents a security risk to applications that expose sensitive native methods to untrusted WebView content and use unsafe DOM insertion, but it does not contain standalone malware or supply-chain compromise behavior.