The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Android Debug Bridge (adb) for device interaction, including pushing binaries to the file system, modifying permissions, and launching specific app components. It also utilizes the frida CLI and objection for dynamic analysis.
[DATA_EXFILTRATION]: The playbook describes techniques for extracting sensitive application information, such as using adb backup to retrieve local files, querying content providers for database contents, and utilizing Frida scripts to dump SharedPreferences and capture cryptographic keys. These actions are scoped to the target application being tested during an authorized assessment.
[REMOTE_CODE_EXECUTION]: The skill provides numerous JavaScript templates for use with the Frida instrumentation framework. These scripts dynamically hook into a target application's runtime to bypass security checks or monitor activity. The skill also documents how to test for WebView-based Remote Code Execution vulnerabilities in target apps.
[PROMPT_INJECTION]: 1. Ingestion points: The agent is instructed to analyze Android application metadata, manifests, and database query results. 2. Boundary markers: No specific boundary markers are provided to mitigate the risk of malicious strings within the target application. 3. Capability inventory: The skill allows for system interaction through adb and frida tools. 4. Sanitization: The instructions do not include steps for sanitizing content retrieved from analyzed applications.

android-pentesting-tricks