apk-redteam-pipeline

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly searches for and displays full secret patterns and example tokens (JWTs, API keys) and instructs testing credentials (e.g., awscli tests and token forging), which requires handling or outputting secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Multiple URLs point to third-party APK repositories (APKPure, APKMirror) and a Firebase Storage endpoint which are commonly used to host unvetted APKs or arbitrary files and can be abused to distribute malware; the remaining URLs (GitHub jadx release, Play Store, Google APIs, mitm.it) are known/official services and are lower risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill document explicitly instructs how to locate, extract, and abuse hardcoded secrets/tokens (including via stealer logs), bypass TLS pinning, intercept runtime traffic, and use extracted credentials to access cloud/APIs — a clear offensive/exfiltration and exploitation playbook suitable for malicious abuse.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill installation steps include a direct wget of the jadx release archive (https://github.com/skylot/jadx/releases/latest/download/jadx-1.5.x.zip) which is fetched during runtime/setup and is a required external binary that will be executed as part of the decompilation pipeline.