The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted third-party mobile application bundles (APK, AAB, IPA) and their extracted contents.
Ingestion points: The agent processes sensitive files such as AndroidManifest.xml, Info.plist, compiled bytecode (index.android.bundle), and native libraries (libapp.so).
Boundary markers: There are no instructions for the agent to use specific delimiters or protective warnings when reading data extracted from these bundles.
Capability inventory: The skill provides the agent with extensive capabilities, including shell execution (bash), device management (adb), and network access (curl, mitmproxy).
Sanitization: The methodology does not include explicit sanitization of strings or data extracted from the application artifacts before they are interpreted by the agent.
[EXTERNAL_DOWNLOADS]: The skill downloads various security tools and dependencies from trusted GitHub repositories.
Evidence: Fetches frida-server from the official Frida GitHub releases, clones the blutter repository for Flutter analysis, and installs the hermes-dec decompiler. These sources are considered trusted and appropriate for the skill's context.
[COMMAND_EXECUTION]: The skill's methodology relies heavily on executing security utilities and command-line tools via the system shell.
Evidence: Extensive use of adb for Android device interaction, apktool for resource decoding, jadx for Java/Kotlin decompilation, and objection for runtime instrumentation.
[DYNAMIC_EXECUTION]: The skill uses advanced dynamic analysis techniques to inspect and modify application behavior at runtime.
Evidence: Instructs the use of LD_PRELOAD to intercept library calls in native Android components and utilizes Frida hooks to bypass security controls like SSL pinning and biometric authentication.
[PRIVILEGE_ESCALATION]: The skill requires administrative privileges to perform deep inspection of mobile devices.
Evidence: The methodology includes using adb root and su commands to deploy instrumentation tools and access protected application sandboxes.

mobile-security