abisheikM1
Community@abisheikM1
Autonomous Android application security testing skills covering APK decompilation, static audits, dynamic verification, backend API testing, and adversarial finding validation for bug bounty.
Agent Skills by abisheikM1
Showing 15 vetted skills indexed across 1 GitHub repositories.
abisheikM1exported-components
Detect unguarded exported Android IPC components and generate adb and Drozer test commands.
abisheikM1codeexec-audit
Detect Android code-execution sinks fed by attacker-controlled data in decompiled APKs.
abisheikM1webview-audit
Detects Android WebView vulnerabilities like JS bridges, file theft, UXSS, and SSRF from decompiled sinks.
abisheikM1apk-recon
Detect secrets, insecure storage, weak crypto, and misconfigurations in Android APKs.
abisheikM1api-pivot
Tests server-side API vulnerabilities discovered through Android app traffic interception.
abisheikM1implicit-intent-audit
Detect implicit-intent, broadcast, and PendingIntent leaks in decompiled Android apps.
abisheikM1local-auth-audit
Detect bypassable client-side biometric, PIN, and session-token authentication in decompiled Android apps.
abisheikM1deps-audit
Inventory bundled third-party libraries in Android APKs and map versions to known CVEs.
abisheikM1deeplink-audit
Detect Android deep link and URL handling vulnerabilities from manifest data.
abisheikM1native-audit
Audit bundled Android native libraries and the JNI boundary for memory corruption and RCE flaws.
abisheikM1decompile-threat-review
Decompile Android APKs and run multi-agent static review to produce threat models and candidate vulnerability reports.
abisheikM1courtroom-verdict
Adjudicates confirmed Android security findings through adversarial prosecution, defense, and judge subagents.
abisheikM1pentest-runbook
Orchestrates an end-to-end authorized Android APK pentest pipeline across four staged skills.
abisheikM1api-vuln-test
Tests backend API endpoints for IDOR, broken auth, and access control flaws via Burp replay.
abisheikM1dynamic-verify
Verify static Android pentest findings on an emulator with Burp interception and Frida pinning bypass.
Frequently Asked Questions About abisheikM1
FAQPage SchemaWhat tasks can I perform with abisheikM1's Android security skills?▼
You can audit exported IPC components, deep links, WebViews, implicit intents, native libraries, dependencies, local authentication, and hardcoded secrets in an APK. You can also run a full autonomous pentest: decompile, dynamically verify findings on an emulator, test backend APIs, and generate adjudicated reports.
Who are these Android pentest skills designed for?▼
They target bug bounty hunters and mobile security engineers testing Android applications. Skills fire on natural phrasings like 'pentest this app', 'bypass SSL pinning', or 'IDOR/BOLA', and assume familiarity with APKs, Burp interception, Frida hooking, and decompiled smali or Java source.
How does the end-to-end pentest pipeline execute?▼
The pentest-runbook orchestrates four stages: decompile-threat-review (apktool/jadx static analysis), dynamic-verify (emulator install, Burp proxying, SSL pinning bypass), api-vuln-test (backend endpoint testing), and courtroom-verdict (adversarial finding validation). Structured JSON passes through targets/<apk-sha256>/ between stages.
What prerequisites and dependencies do these skills require?▼
You need an Android emulator, Burp Suite with a configured CA certificate, apktool and jadx for decompilation, and Frida or Objection for runtime instrumentation. Dynamic verification consumes threat_model.json and report.json from the static review stage, and API testing requires working HTTPS interception.
How are confirmed vulnerabilities validated before reporting?▼
The courtroom-verdict skill puts each confirmed finding on trial: a prosecution subagent argues exploitability from the evidence, a defense subagent argues against it, and a judge subagent independently re-checks both. Only guilty verdicts produce final per-finding markdown reports under report/<package>/.