What problem does it solve? Manually reviewing a decompiled Android app for vulnerabilities is slow and error-prone: large codebases get skimmed, cross-file attack chains get missed, and findings lack the concrete verification steps needed for dynamic testing. This Skill automates the first stage of an authorized Android pentest by decompiling an APK and coordinating a multi-agent adversarial review that outputs a structured threat model and a prioritized candidate-findings report. ## Core Features & Use Cases - Automated decompilation and inventory: Runs apktool and jadx (PATH or vendored jars), hashes the APK into a targets/<sha256>/ workspace, fingerprints frameworks, and flags jadx decompile failures and heavily R8/ProGuard-obfuscated classes that require a smali pivot. - Multi-agent adversarial review: A threat-model-builder subagent plus four parallel rubric-lens subagents review the tree against a 13-category vulnerability catalog, with skeptic subagents attempting to refute each candidate finding before it ships. - Coverage and chain synthesis: coverage.py surfaces large unreviewed source files, and chain_graph.py cross-references entry points with findings to catch multi-hop chains (e.g., exported component forwarding an Intent to a path-traversal sink). - Use Case: Drop an authorized APK into apk/, run the inventory script, and receive threat_model.json plus report.json/report.md where every finding carries an exact dynamic verification plan (adb/Frida/Burp commands) ready for the dynamic-verify stage. ## Quick Start Place an APK you are authorized to test into the apk/ directory and ask the agent to decompile it and build a threat model with candidate vulnerabilities.
