adb-bypass

SUSPICIOUS/HIGH-RISK vulnerable skill. Its footprint is coherent with its stated purpose, but that purpose is to help an AI agent validate and operationalize Play Integrity bypassing, an evasion/security-abuse capability. No clear credential theft or exfiltration is shown, and installer trust is mostly standard, so this is not confirmed malware; the main risk is enabling automated bypass verification on real devices.

No clear evidence of malware behaviors like data theft, exfiltration, persistence, or reverse shells in this code fragment. The primary security risk is host-side command injection: subprocess.run(..., shell=True) executes a command string built with unsanitized, user-controlled device_id (used in adb -s {device_id}). The module’s integrity-bypass-related checks (Magisk/Zygisk, Play Integrity Fork, and a specific app) suggest potential for abuse, but within this snippet it functions as a remote diagnostic/pre-flight validator. Recommend removing shell=True and passing subprocess arguments as a list, plus strict validation/whitelisting of device_id format to prevent injection.

No direct malware payload indicators are present in the provided fragment (it contains no embedded exploit/payload or exfiltration behavior). However, the workflow is explicitly designed to validate an integrity-evasion bypass (PIF via Magisk) against Google Play Services/Play Store, which is security-circumvention functionality and carries elevated misuse risk. Additional risk may come from collecting identifiers (fingerprint/CPU ABI) and capturing device screen state for reports. Further assessment of the referenced orchestrator/scripts would be needed to confirm whether any additional harmful behaviors exist beyond the described testing/validation.

This fragment shows an ADB workflow orchestrator configured to run an explicitly named “adb-bypass” integrity verification workflow against a specific remote device, with an accompanying risk assessment focused on spoofing/detection evasion signals (e.g., Magisk/debug/integrity-hook visibility). While the snippet does not provide implementation details needed to prove data theft or persistence, the evasion-oriented intent and active device targeting make this a significant supply-chain security concern. Review the actual orchestrator script and the referenced workflow steps to determine whether they modify system/security components and whether they include additional harmful behaviors.