What problem does it solve? Static code review of an Android APK produces candidate findings, but none of them are trustworthy until they are reproduced against the running app. This Skill takes the report.json and threat_model.json produced by the decompile stage, runs the app on your own emulator, routes traffic through Burp (defeating SSL pinning when needed), and confirms or refutes each finding with captured evidence. ## Core Features & Use Cases - Emulator verification workflow: Installs and launches the APK, scaffolds per-finding evidence directories, prints each finding's verification plan, and records confirmed / not-reproduced / needs-manual verdicts back into report.json. - HTTPS interception and pinning bypass: Guides Burp proxy and system-CA setup, tries generic Objection/Frida unpinning first, then drives a subagent to read the actual pinning code and write a targeted Frida hook saved to targets/<hash>/frida/bypass.js. - Automated surface fuzzing: fuzz_surface.py mutates exported components, deep links, and content providers from the threat model with adversarial input, watches logcat for crashes, and appends any crash as a new candidate finding. - Use Case: After a static review flags an exported activity and a pinned HTTPS API, run this Skill to install the app on your emulator, bypass the pinning, reproduce the exported-component exploit via adb, and capture logcat and Burp evidence before reporting. ## Quick Start Ask the agent to verify the findings from the decompile report by installing the APK on your emulator, setting up Burp interception, and running each finding's verification plan.
