What problem does it solve? Running a full Android app pentest requires coordinating static decompilation, dynamic emulator verification, API testing, and finding validation as separate manual steps; this Skill chains them into one autonomous, resumable pipeline keyed by the APK's SHA-256. ## Core Features & Use Cases - Four-stage orchestration: Drives decompile-threat-review, dynamic-verify, api-vuln-test, and courtroom-verdict back-to-back with no manual gate, passing structured JSON through targets/<apk-sha256>/. - Preflight gating: Runs preflight_check.py before static and dynamic stages so missing tools (adb, frida-server, emulator, Burp) stop the run instead of failing mid-stage. - Adversarial validation: Every confirmed finding goes through a prosecution/defense/judge trial, and only guilty verdicts produce final reports under report/<package>/. - Use Case: Drop an authorized APK into apk/ and say "run the full pipeline" — the Skill decompiles it, builds a threat model, verifies findings on your emulator, tests the API surface, and writes courtroom-vetted vulnerability reports. ## Quick Start Drop your authorized APK into the apk/ folder and ask the agent to run the full pentest pipeline end to end on it.
