What problem does it solve? Android apps often ship with hardcoded API keys, insecure storage settings, weak cryptography, and risky manifest flags that are tedious to hunt manually across decompiled code. This Skill runs a broad first-pass recon sweep over an APK to surface those exposure leads and prioritize which ones deserve deeper investigation. ## Core Features & Use Cases - Manifest & secrets correlation: Combines parse_manifest.py and scan_secrets.py output into one prioritized summary via recon_summary.py, bucketing findings into pivot, verify, and high lanes with severities. - Weak crypto and TLS detection: Provides grep passes for ECB/DES ciphers, static IVs, MD5/SHA-1, insecure randomness, and trust-all TrustManagers, plus Network Security Config review. - Dynamic verification guidance: Supplies human-run adb commands for adb backup extraction, run-as sandbox inspection, logcat secret hunting, and MediaProjection/lockscreen notification checks. - Use Case: You receive an authorized Android app to pentest. Run the recon pass to immediately surface a hardcoded Firebase URL and an allowBackup flag, then hand the live endpoint to API testing and verify the backup actually contains session tokens before reporting. ## Quick Start Ask the agent to run a first-pass secrets and configuration recon on the APK in the apk/ directory and summarize the prioritized findings.
