android-vuln-analyzer

Name: android-vuln-analyzer
Author: xwtro0tk1t-cloud

320stars42forks

How to install android-vuln-analyzer?

xwtro0tk1t-cloud/harness/android-vuln-analyzer

$npx -y skills add xwtro0tk1t-cloud/harness --skill android-vuln-analyzer

Installs into the current project.

Summary

This skill provides three primary modes for Android security testing:

Files · 1

View on GitHub

SKILL.md

1	# Android Vulnerability Analyzer - Universal Skill
2
3	## Overview
4
5	This skill provides three primary modes for Android security testing:
6
7	1. Reproduction Mode: Recreate known vulnerabilities from CVE reports, bug bounty submissions, or vulnerability disclosures
8	2. Hunting Mode: Actively search for specific types of vulnerabilities using pre-built hunt patterns
9	3. SAST Verification Mode: Verify and validate alerts from SAST tools (MobSF, SonarQube, AI SAST, Qark) with PoC generation and dynamic testing
10
11	All modes generate reusable documentation (prompt.md) for future reproduction or knowledge sharing.
12
13	## Command Format
14
15	```bash
16	/android-vuln-analyzer <path_to_apk> <path_to_case_or_hunt>
17	```
18
19	Parameters:
20	- `<path_to_apk>`: Target APK file to analyze
21	- `<path_to_case_or_hunt>`: Directory with vulnerability case, report, or hunt pattern
22
23	Examples - Reproduction Mode:
24	```bash
25	# Fast reproduction (has prompt.md)
26	/android-vuln-analyzer phemex.apk examples/phemex
27
28	# First-time reproduction (has report.txt)
29	/android-vuln-analyzer app.apk cases/new-vuln/
30
31	# Full discovery (empty directory)
32	/android-vuln-analyzer unknown.apk cases/investigation/
33	```
34
35	Examples - Hunting Mode: ⭐
36	```bash
37	# Hunt for hardcoded API keys
38	/android-vuln-analyzer app.apk hunts/hardcoded-secrets/
39
40	# Hunt for SQL injection
41	/android-vuln-analyzer app.apk hunts/sql-injection/
42
43	# Hunt for WebView vulnerabilities
44	/android-vuln-analyzer app.apk hunts/webview-vulnerabilities/
45	```
46
47	## Required Tools and Environment Setup
48
49	⚠️ Step 7 (Dynamic Verification) requires specific tools. Install these BEFORE starting verification.
50
51	### Essential Tools
52
53	\| Tool \| Purpose \| Installation \| Version \|
54	\|------\|---------\|--------------\|---------\|
55	\| Android SDK \| Emulator, adb \| [Android Studio](https://developer.android.com/studio) \| Latest \|
56	\| mitmproxy \| MITM testing, cert pinning \| `brew install mitmproxy` \| 12.0+ \|
57	\| frida \| Runtime hooking \| `pip3 install --break-system-packages frida frida-tools` \| 17.0+ \|
58	\| frida-server \| Device-side Frida \| [Download from GitHub](https://github.com/frida/frida/releases) \| Match frida version \|
59	\| tcpdump \| Network capture \| Pre-installed on emulators \| Any \|
60
61	### Quick Setup
62
63	```bash
64	# 1. Install host tools
65	brew install mitmproxy
66	pip3 install --break-system-packages frida frida-tools
67
68	# 2. Download and deploy frida-server
69	FRIDA_VERSION=$(frida --version)
70	curl -L -o frida-server.xz \
71	"https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz"
72	unxz frida-server.xz
73	adb push frida-server /data/local/tmp/frida-server
74	adb shell chmod 755 /data/local/tmp/frida-server
75	adb shell /data/local/tmp/frida-server &
76
77	# 3. Verify setup
78	mitmproxy --version
79	frida --version
80	frida-ps -D $(adb devices \| grep -v "List" \| awk '{print $1}' \| head -1)
81	```
82
83	### Common Installation Pitfalls
84
85	⚠️ Pitfall #1: `externally-managed-environment` error when installing frida
86	- Solution: Add `--break-system-packages` flag to pip3
87
88	⚠️ Pitfall #2: frida version mismatch with frida-server
89	- Solution: Always match versions exactly (`frida --version` = frida-server version)
90
91	⚠️ Pitfall #3: Wrong frida-server architecture
92	- Solution: Check emulator arch with `adb shell getprop ro.product.cpu.abi`
93	- `arm64-v8a` → use `frida-server-*-android-arm64.xz`
94	- `x86_64` → use `frida-server-*-android-x86_64.xz`
95
96	⚠️ Pitfall #4: frida-server permission denied
97	- Solution: `adb shell chmod 755 /data/local/tmp/frida-server`
98
99	⚠️ Pitfall #5: Frida `--no-pause` flag not recognized
100	- Solution: Remove flag (not supported in all versions)
101
102	📖 Complete guide: See `ENVIRONMENT_SETUP.md` for detailed troubleshooting
103
104	### Recommended Emulator Configuration
105
106	- API Level: 34-35 (Android 14-15)
107	- Architecture: arm64-v8a (better app compatibility)
108	- Device: Pixel 8 Pro or similar
109	- Storage: 8GB+
110
111	```bash
112	# Create emulator
113	avdmanager create avd -n Pixel_8_Pro_API35_arm \
114	-k "system-images;android-35;google_apis;arm64-v8a" \
115	-d "pixel_8_pro"
116
117	# Launch emulator
118	emulator -avd Pixel_8_Pro_API35_arm &
119	```
120
121	---
122
123	## Execution Flow
124
125	### Step 1: Parse Input Parameters
126
127	1. Validate APK path - Ensure file exists and is a valid APK
128
129	2. Check case directory structure:
130
131	Scenario A: prompt.md exists ✅ Fast Reproduction
132	```bash
133	/path/to/case/
134	├── prompt.md # Complete reproduction guide
135	└── report_original.txt (optional)
136	```
137	→ Skip to Step 3 (direct execution with known good steps)
138
139	Use Case: Reproducing a vulnerability you or someone else already analyzed
140
141	---
142
143	Scenario B: Only raw report exists 🔄 Learning & Documentation
144	```bash
145	/path/to/case/
146	└── report.txt # Original vulnerability report
147	```
148	→ Go to Step 2 (analyze + reproduce + generate prompt.md)
149
150	Use Case: First-time reproduction from a vulnerability report (e.g., CVE, bug bounty report)

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

android-vuln-analyzer

320stars42forks

View on GitHub

How to install android-vuln-analyzer?

xwtro0tk1t-cloud/harness/android-vuln-analyzer

$npx -y skills add xwtro0tk1t-cloud/harness --skill android-vuln-analyzer

Installs into the current project.

Summary

This skill provides three primary modes for Android security testing:

Files · 1

View on GitHub

SKILL.md

1	# Android Vulnerability Analyzer - Universal Skill
2
3	## Overview
4
5	This skill provides three primary modes for Android security testing:
6
7	1. Reproduction Mode: Recreate known vulnerabilities from CVE reports, bug bounty submissions, or vulnerability disclosures
8	2. Hunting Mode: Actively search for specific types of vulnerabilities using pre-built hunt patterns
9	3. SAST Verification Mode: Verify and validate alerts from SAST tools (MobSF, SonarQube, AI SAST, Qark) with PoC generation and dynamic testing
10
11	All modes generate reusable documentation (prompt.md) for future reproduction or knowledge sharing.
12
13	## Command Format
14
15	```bash
16	/android-vuln-analyzer <path_to_apk> <path_to_case_or_hunt>
17	```
18
19	Parameters:
20	- `<path_to_apk>`: Target APK file to analyze
21	- `<path_to_case_or_hunt>`: Directory with vulnerability case, report, or hunt pattern
22
23	Examples - Reproduction Mode:
24	```bash
25	# Fast reproduction (has prompt.md)
26	/android-vuln-analyzer phemex.apk examples/phemex
27
28	# First-time reproduction (has report.txt)
29	/android-vuln-analyzer app.apk cases/new-vuln/
30
31	# Full discovery (empty directory)
32	/android-vuln-analyzer unknown.apk cases/investigation/
33	```
34
35	Examples - Hunting Mode: ⭐
36	```bash
37	# Hunt for hardcoded API keys
38	/android-vuln-analyzer app.apk hunts/hardcoded-secrets/
39
40	# Hunt for SQL injection
41	/android-vuln-analyzer app.apk hunts/sql-injection/
42
43	# Hunt for WebView vulnerabilities
44	/android-vuln-analyzer app.apk hunts/webview-vulnerabilities/
45	```
46
47	## Required Tools and Environment Setup
48
49	⚠️ Step 7 (Dynamic Verification) requires specific tools. Install these BEFORE starting verification.
50
51	### Essential Tools
52
53	\| Tool \| Purpose \| Installation \| Version \|
54	\|------\|---------\|--------------\|---------\|
55	\| Android SDK \| Emulator, adb \| [Android Studio](https://developer.android.com/studio) \| Latest \|
56	\| mitmproxy \| MITM testing, cert pinning \| `brew install mitmproxy` \| 12.0+ \|
57	\| frida \| Runtime hooking \| `pip3 install --break-system-packages frida frida-tools` \| 17.0+ \|
58	\| frida-server \| Device-side Frida \| [Download from GitHub](https://github.com/frida/frida/releases) \| Match frida version \|
59	\| tcpdump \| Network capture \| Pre-installed on emulators \| Any \|
60
61	### Quick Setup
62
63	```bash
64	# 1. Install host tools
65	brew install mitmproxy
66	pip3 install --break-system-packages frida frida-tools
67
68	# 2. Download and deploy frida-server
69	FRIDA_VERSION=$(frida --version)
70	curl -L -o frida-server.xz \
71	"https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz"
72	unxz frida-server.xz
73	adb push frida-server /data/local/tmp/frida-server
74	adb shell chmod 755 /data/local/tmp/frida-server
75	adb shell /data/local/tmp/frida-server &
76
77	# 3. Verify setup
78	mitmproxy --version
79	frida --version
80	frida-ps -D $(adb devices \| grep -v "List" \| awk '{print $1}' \| head -1)
81	```
82
83	### Common Installation Pitfalls
84
85	⚠️ Pitfall #1: `externally-managed-environment` error when installing frida
86	- Solution: Add `--break-system-packages` flag to pip3
87
88	⚠️ Pitfall #2: frida version mismatch with frida-server
89	- Solution: Always match versions exactly (`frida --version` = frida-server version)
90
91	⚠️ Pitfall #3: Wrong frida-server architecture
92	- Solution: Check emulator arch with `adb shell getprop ro.product.cpu.abi`
93	- `arm64-v8a` → use `frida-server-*-android-arm64.xz`
94	- `x86_64` → use `frida-server-*-android-x86_64.xz`
95
96	⚠️ Pitfall #4: frida-server permission denied
97	- Solution: `adb shell chmod 755 /data/local/tmp/frida-server`
98
99	⚠️ Pitfall #5: Frida `--no-pause` flag not recognized
100	- Solution: Remove flag (not supported in all versions)
101
102	📖 Complete guide: See `ENVIRONMENT_SETUP.md` for detailed troubleshooting
103
104	### Recommended Emulator Configuration
105
106	- API Level: 34-35 (Android 14-15)
107	- Architecture: arm64-v8a (better app compatibility)
108	- Device: Pixel 8 Pro or similar
109	- Storage: 8GB+
110
111	```bash
112	# Create emulator
113	avdmanager create avd -n Pixel_8_Pro_API35_arm \
114	-k "system-images;android-35;google_apis;arm64-v8a" \
115	-d "pixel_8_pro"
116
117	# Launch emulator
118	emulator -avd Pixel_8_Pro_API35_arm &
119	```
120
121	---
122
123	## Execution Flow
124
125	### Step 1: Parse Input Parameters
126
127	1. Validate APK path - Ensure file exists and is a valid APK
128
129	2. Check case directory structure:
130
131	Scenario A: prompt.md exists ✅ Fast Reproduction
132	```bash
133	/path/to/case/
134	├── prompt.md # Complete reproduction guide
135	└── report_original.txt (optional)
136	```
137	→ Skip to Step 3 (direct execution with known good steps)
138
139	Use Case: Reproducing a vulnerability you or someone else already analyzed
140
141	---
142
143	Scenario B: Only raw report exists 🔄 Learning & Documentation
144	```bash
145	/path/to/case/
146	└── report.txt # Original vulnerability report
147	```
148	→ Go to Step 2 (analyze + reproduce + generate prompt.md)
149
150	Use Case: First-time reproduction from a vulnerability report (e.g., CVE, bug bounty report)

People who liked this also viewed

6 picks

Type