adb-magisk-installer

SUSPICIOUS: the skill’s capabilities mostly match its rooting purpose and use largely official sources, but it enables autonomous high-impact device modification and includes an uncorroborated claim about downloading a matching boot image from GitHub releases. No clear credential theft or covert exfiltration is present, but the operational risk is substantial.

No clear evidence of classic malware (exfiltration, credential theft, obfuscated payloads, persistence, or arbitrary host execution) appears in this module. However, the code’s intent and actions automate Magisk-driven boot-image patching—an inherently high-impact, misuse-prone capability. Additionally, it selects the adb pull source path from minimally validated adb stdout, and the snippet appears truncated/logic-mismatched (push_boot_to_device() not called), lowering assurance. Treat as a powerful device-altering tool rather than a likely stealthy malware sample, with moderate uncertainty due to incomplete context.

This is a CLI device-flashing utility that executes fastboot/adb to flash a boot image and optionally reboot/poll boot completion. There is no clear evidence of hidden malware (no obfuscation, no exfiltration, no credential/data theft, no dynamic execution) in the provided fragment. The primary risk is operational/high impact: it can flash arbitrary images to boot-related partitions, and the optional verification is only a file-size heuristic rather than cryptographic integrity/authenticity checking. If run with untrusted inputs (especially boot images), it can facilitate device compromise or disruption as part of an attack chain.

This module is a straightforward ADB-based installer/verifier for the Magisk Manager APK. It does not show overt malware techniques (no obfuscation, exfiltration, persistence, or credential/data theft) within the provided fragment. However, it hardcodes rooting-related identifiers and performs high-impact remote actions (adb install and launching a Magisk activity) without validating APK authenticity (only existence/size). The main security concern is operational misuse or installing an untrusted/tampered APK supplied via --apk-path, rather than covert malicious behavior in the Python code itself.