What problem does it solve? Manually reversing Android apps during a penetration test is slow and error-prone: analysts must hunt down APKs, decompile DEX bytecode, grep for secrets, enumerate exported components, and set up runtime instrumentation by hand. This Skill provides an end-to-end pipeline that turns a target's mobile app catalogue into actionable findings such as hardcoded JWTs, internal API endpoints, and misconfigured Firebase backends. ## Core Features & Use Cases - APK Acquisition & Decompilation: Pull APKs from Play Store developer pages, APKPure, and APKMirror with fallback handling for truncated XAPK files, then decompile with jadx. - Secret & Endpoint Extraction: Run a 60-pattern grep catalog covering AWS keys, Google API keys, JWTs, Firebase configs, OAuth secrets, and internal URLs, plus pinned-certificate extraction that reveals hidden internal hosts. - Runtime Instrumentation: Use Frida and Objection templates for certificate-pinning bypass, HTTP request hooking, and mitmproxy traffic capture to map live API behavior. - Use Case: During an authorized engagement, recon surfaces seven apps under a target's Play Store developer page. The pipeline downloads each APK, decompiles them, and recovers a hardcoded JWT plus 30 internal /v1/* API endpoints from one customer-facing app, producing a report-ready finding. ## Quick Start Ask the agent to enumerate the target's Play Store developer page, download and decompile each APK, and grep the decompiled output for hardcoded secrets, JWTs, and internal API endpoints.
