What problem does it solve? Android deep links are attacker-controlled input delivered one-click from a browser, and apps routinely trust them — loading them into WebViews, forwarding OAuth tokens, or accepting unvalidated redirect URIs. This Skill identifies that attack surface from a parsed AndroidManifest and guides authorized testers through static detection and human-run dynamic confirmation. ## Core Features & Use Cases - Automated deep-link detection: Parses targets/<hash>/manifest.json and classifies every deep link as BROWSABLE, custom-scheme, autoVerify App Link, loose-path, or possible OAuth callback, emitting ready-to-review adb am start commands and assetlinks.json check URLs. - Six-TTP methodology: Covers open redirect/param injection, OAuth redirect_uri interception and account takeover, App Links/assetlinks.json misconfiguration, custom-scheme hijacking, intent:// abuse, and deep-link open redirects, each with preconditions, signals, tests, and cited disclosed reports. - Use Case: Given an authorized APK target, run the bundled detector to enumerate all BROWSABLE intent filters, then fire a crafted myapp://host/path?redirect=https://evil.example URI via adb to confirm an unvalidated redirect before writing up the finding with the included report template. ## Quick Start Ask the assistant to audit the deep links of an authorized APK by running the audit_deeplinks script against its parsed manifest and reviewing the generated adb test commands.
