What problem does it solve? Android apps often enforce authentication decisions on the device rather than the server, letting a rooted attacker flip a boolean, recover a local PIN, or steal a replayable session token. This Skill finds those bypassable local-auth patterns in decompiled APK source and guides authorized testers through confirming them with standard Frida and objection tooling. ## Core Features & Use Cases - Static signal scanning: The bundled scan_auth.py script greps jadx/apktool output for BiometricPrompt, CryptoObject, onAuthenticationSucceeded, KeyguardManager, and client-side PIN equals() comparisons, flagging biometric flows with no CryptoObject as boolean-flip bypass candidates. - TTP catalog with confirmation steps: Three documented techniques (crypto-less biometric bypass, client-side PIN comparison, retrievable session token) each with preconditions, signals, human-run objection/Frida commands, impact ratings, and cited public reports. - Use Case: During an authorized bug bounty engagement, you decompile a target APK, run the scanner, and it flags a BiometricPrompt flow with no CryptoObject; you then confirm the bypass on a rooted emulator using the public Frida CodeShare universal biometric bypass and write up the finding with the provided report template. ## Quick Start Run python skills/local-auth-audit/scripts/scan_auth.py --hash <sha256> against a decompiled target to list client-side authentication signals and their dynamic confirmation hints.
