apk-reverse

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). High risk: this repository intentionally includes Frida hooks and tooling that capture cryptographic keys/tokens/storage, bypass SSL/root checks, and automate rebuilding/signing APKs (with a debug keystore), which enables credential theft and unauthorized repackaging/installation when used against targets without consent.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the provided files for literal, high-entropy credentials (API keys, private keys/PEM blocks, or other random-looking secrets). Findings and rationale:
• I flag debug.keystore (binary keystore content included verbatim). This file contains certificate/private-key material (keystore blobs). Even though the repository also uses the well-known debug keystore/passwords, the keystore file itself is a sensitive artifact because it contains private key material that can be used to sign apps.

Ignored items (not flagged) and why:

• Store/key passwords set to "android" and the alias "androiddebugkey" in scripts/rebuild-sign-install.ps1 (lines 14–18) — these are default debug keystore passwords and low-entropy setup values, so per the rules they are ignored.
• Same defaults present in scripts/rebuild-sign-install.sh (STORE_PASS/KEY_PASS = "android", lines 22–24) — ignored for the same reason.
• Example/local host addresses and ports like "127.0.0.1:27042" and "127.0.0.1:7555" (frida/run scripts and examples) — not secrets.
• Example numeric device identifiers returned in Frida example (IMSI/IMEI-like numbers) in references/frida-cookbook.md (lines ~327–329) — these are example values and not high-entropy credentials.
• Other strings shown are placeholders, examples, or tool names/commands (e.g., YOUR_API_KEY-like placeholders are not present here), and no PEM-formatted private key blocks or API keys (sk-... etc.) were found.

Conclusion: the concrete sensitive artifact is the included debug.keystore file (contains private key material). Other apparent credentials are default/low-entropy examples and intentionally ignored.