android-app-reverse

The skill’s capabilities are consistent with Android reverse engineering, but it grants substantial dual-use access to app traffic, runtime behavior, and cryptographic material. The MCP tool provenance is unclear and should be verified before use. No explicit credential exfiltration, stealth, or malicious payload is described; classify as suspicious/high risk rather than confirmed malware.

This code provides Frida templates for application reverse engineering and debugging, but can expose cryptographic secrets and HTTP data through logs and dump executable DEX contents to /data/local/tmp. These are sensitive collection behaviors when used without authorization; the fragment itself shows no remote exfiltration or installation-time malware behavior. Severity is moderate to high in an unauthorized instrumentation context, with no suspicious domain, URL, IP address, or environment-variable access present.

该文档说明如何绕过 Android 应用的 TLS 证书和主机名校验、修改 APK 信任配置及将代理 CA 安装到系统证书库。主要风险是 HTTPS 流量可能被中间人拦截，且部分操作会降低设备或应用的安全性；文档还建议规避 Frida 检测。未发现数据外传目标、凭据窃取代码或破坏性载荷，因此这是高风险的安全削弱指南，但没有明确证据表明代码本身是恶意软件。