ptn1411/skill/android-apk-pentester

Name: android-apk-pentester
Author: ptn1411

Claude Code and agent skill by ptn1411/skill

Trust tier 2

community

LLM review pending

Source check pending

Checking that the SKILL.md file is still in the repository.

Use when performing authorized Android APK, XAPK, or APKS security testing that needs static analysis, split install handling, rooted emulator setup, mitmproxy interception, Frida hook generation, or emulator/root detection validation.

Install

npx vskill@latest install ptn1411/skill/android-apk-pentester

SKILL.md

Android APK Pentester

Purpose

Use this skill for authorized Android application security testing. It supports static APK/XAPK/APKS analysis, split APK installation, rooted emulator setup, traffic interception, and Frida hook generation for lab validation.

Load references/android_pentest_patterns.md when you need detailed detection vectors, certificate injection notes, APK format differences, or native protection signatures.

Workflow

Phase	Script	Purpose
0	`scripts/setup_avd.py`	Start/configure an emulator, enable adb root/remount, push `frida-server`
1	`scripts/analyze_apk.py`	Extract manifest metadata, permissions, DEX strings, native libs, and protection indicators
2	`scripts/install_apk.py`	Install APK, XAPK, split APKs, or bundletool APKS archives
3	`scripts/disguise_emulator.py`	Apply lab emulator property/profile changes and verify common emulator markers
4	`scripts/setup_intercept.py`	Inject mitmproxy CA into system store and configure device proxy
5	`scripts/generate_hooks.py`	Generate Frida scripts for SSL pinning tests, crypto logging, and detection validation

Usage

bash

# Prepare emulator command plan first
python android-apk-pentester/scripts/setup_avd.py --avd Pixel_API_35 --frida-server frida-server --writable-system --dry-run
 
# Static analysis
python android-apk-pentester/scripts/analyze_apk.py app.apk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.xapk --out output/apk-analysis
python android-apk-pentester/scripts/analyze_apk.py app.apks --out output/apk-analysis
 
# Install packages
python android-apk-pentester/scripts/install_apk.py app.apk
python android-apk-pentester/scripts/install_apk.py app.xapk
python android-apk-pentester/scripts/install_apk.py app.apks --bundletool bundletool.jar
 
# Interception and dynamic validation
python android-apk-pentester/scripts/setup_intercept.py --inject-cert --set-proxy
python android-apk-pentester/scripts/generate_hooks.py --target com.example.app --all --out hooks/

Outputs

File	Content
`apk_analysis.json`	Manifest metadata, permissions, components, strings, native libs, findings
`hooks/*.js`	Generated Frida scripts for authorized runtime testing
`hooks/hooks_manifest.json`	Hook selection and run commands
`intercept/`	Optional mitmproxy capture output

Practical Notes

Use setup_avd.py --dry-run before changing an emulator.
Use .apks only with bundletool.jar or BUNDLETOOL_JAR.
Android 7+ apps usually ignore user CAs; use system CA injection in the lab emulator.
Re-run disguise_emulator.py after each cold boot because property changes are RAM-only.
Prefer physical devices for targets that rely on hardware-backed attestation.

Anti-Patterns

Mistake	Fix
Running emulator setup without preview	Use `setup_avd.py --dry-run` first
Treating APKS as a ZIP of directly installable APKs	Use `bundletool install-apks` via `install_apk.py`
Using only a user-installed CA	Inject the CA into the system trust store on a test emulator
Forgetting split APK order	Use XAPK extraction or bundletool instead of manual `adb install`
Assuming every detection vector is bypassable	Hardware attestation and kernel-level checks need a physical device

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingandroid-apk-pentester/SKILL.md

Popularity

Repository stars: 150
Repository forks: 90
7-day trend score: 25

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/ptn1411/skill/android-apk-pentester/badge)](https://verified-skill.com/skills/ptn1411/skill/android-apk-pentester)

Something wrong with this skill or its page? Tell us.