What problem does it solve? Android apps bundle dozens of third-party SDKs whose known vulnerabilities become the app's attack surface, but manually identifying every bundled library and checking its version against CVE feeds is slow and error-prone. This Skill automates the inventory of native libraries, SDK package roots, and version metadata so you can quickly map shipped dependencies to known vulnerabilities. ## Core Features & Use Cases - Bundled Library Inventory: Scans extracted APK directories for native .so libraries (with ABI), third-party SDK smali package roots matched against a built-in signature map (OkHttp, Play Core, Jackson, Facebook, AppsFlyer, and more), and version-hint files like pom.properties and BuildConfig. - CVE Lookup Guidance: Prints OSV, NVD, and GHSA search URLs for every detected SDK so you can confirm the shipped version against live advisory feeds. - Tracker PII Detection: Flags analytics and attribution SDKs (Facebook, AppsFlyer, Adjust, Branch, Flurry) for follow-up dynamic observation of PII exfiltration over Burp or mitmproxy. - Use Case: During an authorized Android pentest, run the inventory script against a decompiled target to discover the app bundles Google Play Core 1.7.1, then confirm CVE-2020-8913 on NVD and hand the code-execution analysis to a companion exploitation skill. ## Quick Start Ask the agent to inventory the bundled third-party libraries and SDKs in the extracted APK under targets/<hash> and list which ones have known CVEs.
