apk-reverse

This module is a dual-use Frida orchestration wrapper that can enumerate devices/processes and attach/spawn to a selected package/process while loading a caller-provided Frida script. The main supply-chain/execution-integrity risks are (1) auto-bootstrap that runs a relative bootstrap PowerShell script using -ExecutionPolicy Bypass, and (2) direct loading of an external Frida script from an unvalidated path. No explicit credential theft, persistence, or network exfiltration logic is visible in this snippet; however, the capabilities and execution pivots make misuse or compromise of the bootstrap/script inputs a significant security concern.

该 skill 的能力与“APK 逆向”目的基本一致，但它为 AI 代理提供了完整的逆向、修改、重打包、安装与 Frida 注入链路，并明确支持绕过 root/SSL/调试检测，属于高风险攻防工具类 skill。未见明确凭证窃取或外传逻辑，因此不像恶意软件；主要问题是对真实设备和应用的高影响操作能力，以及按需自举带来的供应链风险。

The reviewed fragment does not include the actual Frida script code, but it clearly describes a turnkey runtime bypass kit that can disable root/emulator/anti-debug checks and bypass TLS certificate-chain validation/SSL pinning by hooking TrustManagerImpl methods. This functionality is highly dual-use and materially increases misuse potential, especially due to the claimed certificate-validation bypass. No direct evidence of extra malware behaviors (exfiltration, persistence, etc.) is present in the fragment, but such behaviors cannot be ruled out without inspecting the real script.

This fragment is a dual-use Frida toolkit template collection. It contains multiple explicit security-bypass hooks (SSL pinning/trust verification bypass, root/anti-debug/emulator spoofing) and extensive logging of sensitive data (crypto inputs/keys/IVs, HTTP headers, SharedPreferences, SQLite queries). While it does not show direct malware behaviors like persistence or network exfiltration to a remote host, it significantly increases attacker capability and would be high-risk if bundled into a software supply chain without a legitimate purpose.

This fragment is highly indicative of malicious or at least strongly abuse-capable behavior: it performs live instrumentation to disable TLS certificate pinning/peer verification (OkHttp and native Flutter paths) and to evade root/debug/integrity checks (File.exists and System.getProperty overrides, plus native function replacement). In a supply-chain context, inclusion of such code would represent a severe security risk because it can enable MITM attacks and bypass app integrity controls.

This module is primarily an orchestrator for running jadx and apktool on a provided APK and extracting basic metadata. It does not show direct malicious behavior (no exfiltration/persistence/credential theft). However, it meaningfully increases supply-chain/execution risk by (1) dot-sourcing a tool-discovery dependency that controls what binaries/args are executed and (2) auto-bootstrap via powershell.exe -ExecutionPolicy Bypass to run a bootstrap script when tools are missing. Additionally, recursive deletion under user-influenced output paths can be destructive if paths are misconfigured or manipulated. Treat as medium supply-chain risk pending verification of ToolDiscovery.ps1 and bootstrap-reverse.ps1 integrity and download/install behavior.