The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to fetch reverse-engineering tools from external GitHub repositories, such as worawit/blutter, rscloura/Doldrums, and Impact-I/reFlutter.\n- [REMOTE_CODE_EXECUTION]: Instructions involve downloading external code and executing it locally, such as running blutter.py after a git clone. The skill also describes an advanced technique for dynamic execution by compiling a custom C harness (loader.c) at runtime to execute and intercept functions from extracted native libraries using dlopen and LD_PRELOAD.\n- [COMMAND_EXECUTION]: Utilizes multiple shell commands to analyze mobile artifacts, including unzip, objdump, nm, and python3.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process untrusted mobile application packages and binaries.\n
Ingestion points: Processes compiled artifacts including APK/IPA files, Dart AOT snapshots (libapp.so), and native shared objects (.so).\n
Boundary markers: No instructions are provided to the agent to treat binary content as untrusted or to ignore instructions embedded within the data.\n
Capability inventory: The skill allows the agent to execute shell commands, install dependencies via pip, and compile/run native code.\n
Sanitization: No sanitization or verification steps are specified for the mobile application artifacts before they are analyzed or executed within the harness.

mobile-security