What problem does it solve? Android WebViews concentrate XSS, local file theft, SSRF, and even RCE risks in one component, and manually auditing decompiled code for every dangerous configuration is slow and error-prone. This Skill automates the static detection of WebView attack surface and guides authorized testers through human-run dynamic confirmation. ## Core Features & Use Cases - Automated sink detection: Consumes sinks.json from the harness, filters WebView-relevant sinks (addJavascriptInterface, loadDataWithBaseURL, setAllowFileAccess, loadUrl, onReceivedSslError, and more), ranks them by severity, and groups them by source file. - TTP catalog and chaining playbook: Ten documented attack techniques with preconditions, signals, tests, and impact, plus cross-skill chains with deeplink-audit, exported-components, and api-pivot. - Safe, authorized-only workflow: Ships detection and methodology only — dynamic steps are described for a human to run against an authorized device, with no weaponized exploit HTML/JS. - Use Case: After decompiling an in-scope APK, run the detector to instantly surface a high-severity addJavascriptInterface bridge, then follow the documented steps to deliver a deep link into the hosting activity and confirm token theft via Burp. ## Quick Start Run the bundled audit script against your target's sinks.json with a command like: python skills/webview-audit/scripts/audit_webview.py --hash <sha256> to get a ranked WebView attack-surface report.
