What problem does it solve? Android apps that send Intents or broadcasts without pinning a recipient leak sensitive extras (tokens, PII, auth codes) to any installed app, and mutable PendingIntents let attackers act with the app's identity. Manually grepping decompiled source for these patterns is slow and error-prone. ## Core Features & Use Cases - Static sink detection: Consumes sinks.json from the harness and flags sendBroadcast, setAction, and implicit startActivity sinks, downgrading hits that pin a component and flagging mutable PendingIntents. - Human-run dynamic test hints: Generates adb, am, and Drozer commands for an authorized tester to confirm which apps resolve an action or receive leaked extras. - TTP catalog and chaining playbook: Five documented techniques (T1-T5) mapped to MASVS/MASTG, with chaining paths into api-pivot, exported-components, and webview-audit. - Use Case: During an authorized bug bounty assessment, run the detector against a decompiled APK to find an unprotected sendBroadcast leaking a session token, then confirm it on a test device with a benign logging receiver. ## Quick Start Run the implicit-intent-audit detector against the sinks.json for my target APK hash and list every broadcast or implicit intent that could leak sensitive extras.
