android-app-pentesting
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Provides instructions for using ADB and various command-line tools for application analysis and manipulation.
- [EXTERNAL_DOWNLOADS]: References tools and scripts from official package registries (PyPI, NPM) and GitHub repositories, including vendor-specific tools such as
droidasc. - [INDIRECT_PROMPT_INJECTION]: Identifies an attack surface where the agent processes untrusted APK content and tool outputs. -- Ingestion points: APK files, AndroidManifest.xml, and analysis tool logs. -- Boundary markers: Not present. -- Capability inventory: Extensive shell execution and file manipulation tools. -- Sanitization: Not present.
- [DYNAMIC_EXECUTION]: Employs Frida for runtime instrumentation, which involves injecting and executing JavaScript within a target process for security analysis.
Audit Metadata