android-semantic-vuln-hunting

What problem does it solve?

This skill solves the critical gap where automated Android scanners produce noisy generic warnings while missing impactful logic bugs that require semantic reasoning. It enables security researchers and red teamers to systematically hunt deep link vulnerabilities, intent redirection flaws, WebView trust boundary breaches, exported component abuse, and auth/session bypasses in Android APKs at both corpus scale and single-APK depth.

Core Features & Use Cases

• Corpus-scale triage with risk-prioritized ranking: Processes thousands of components across dozens of APKs to identify the 1% of attack surface that warrants deep reading, using a scoring system that weights exported BROWSABLE activities, wildcard hosts, and high-risk intent filters.
• Three-mode pipeline (A/B/C): Supports single-APK depth assessment, broad corpus coverage funnels with tiered escalation from inventory through component ranking, decompilation, ripgrep, Semgrep, and Joern or CodeQL, and per-impact-class targeted hunting for specific app categories like wallets, password managers, and messengers.
• Hybrid runtime analysis: Traces into React Native JavaScript bundles, Hermes bytecode, and Flutter Dart AOT binaries to validate Java-side bridge findings against actual route maps and allowlists before grading confidence.
• Backend API discovery: Extracts API maps from decompiled sources to identify BOLA, workflow bypass, mass assignment, SSRF, and GraphQL or gRPC operation abuse surfaces invisible from public web crawls.

Quick Start

Use the android-semantic-vuln-hunting skill to analyze the provided Android APK corpus by first running a corpus inventory, ranking exported components, and then decompiling only the top-scoring targets before searching for deep link and WebView vulnerability patterns.