apk-reverse
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill implements an 'On-Demand Bootstrap' mechanism that automatically fetches tools like jadx and apktool from GitHub Releases, and frida-tools via pip from PyPI. These are recognized, well-known services for hosting developer and security tooling. The skill also references community-maintained Frida scripts and bypass kits from GitHub repositories.
- [COMMAND_EXECUTION]: The skill frequently executes command-line utilities including adb for device communication, apktool for resource management, jadx for Java decompilation, and Frida for dynamic instrumentation. It provides several PowerShell scripts to automate complex multi-step workflows such as rebuilding, signing, and installing modified APKs.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external APK files and Manifest data, which constitutes an ingestion surface for untrusted data. To mitigate potential exploitation, the skill defines a 'Mandatory confirmation gate' that requires the agent to obtain explicit user verification regarding the target, scope, and specific command effects before performing any invasive or extractive actions.
- [DYNAMIC_EXECUTION]: The skill utilizes the Frida framework to perform dynamic instrumentation, allowing for runtime modification and inspection of Java and native code within target Android processes. It also employs PowerShell scripts to dynamically manage the analysis environment and toolchain setup.
Audit Metadata