技能 apktool 審計紀錄
📦

審計紀錄

apktool - 6 審計

審計版本 6

最新 中風險

Jun 28, 2026, 05:56 PM

Static analysis flagged many shell-command examples, secret-search terms, keystore references, and one /dev/null redirect. Review found these are mostly expected apktool guidance, not malware or prompt injection, but the skill remains medium risk because it guides command execution and dual-use APK reverse engineering.

1
已掃描檔案
529
分析行數
9
發現
codex
審計單位
中風險問題 (3)
Extensive Shell Command Guidance
The skill repeatedly instructs users to run apktool, grep, find, strings, keytool, jarsigner, and shell pipelines against APK-derived files. This is legitimate for apktool analysis, but it creates command execution risk if users substitute untrusted paths or run commands in unsafe directories. Confidence: 0.82. Confidence reasoning: The commands are explicit and numerous, but they are documented examples for the stated security workflow rather than hidden execution logic.
Dual-Use APK Reverse Engineering and Repackaging
The skill teaches APK decoding, smali/resource inspection, rebuilding, and signing. These capabilities support authorized security work, but can also support unauthorized app modification if misused. Confidence: 0.78. Confidence reasoning: The dual-use capability is clear from the documented workflows, while the file also includes ethics guidance limiting use to authorized APKs.
Generated Shell Script Execution
The guide shows users how to create analyze.sh, make it executable, and run it over an unpacked APK directory. The script content is simple search logic, but generated executable scripts increase operational risk if copied into untrusted workspaces. Confidence: 0.76. Confidence reasoning: The script creation and execution steps are direct, but there is no evidence of persistence, obfuscation, network exfiltration, or malicious payloads.
低風險問題 (4)
Secret Search Terms Are False Positive Credential Access
The scanner flagged env_access around api_key and secret terms, but the line is a grep command that searches decoded resources for hardcoded credentials. It does not read environment variables or local secret stores. Confidence: 0.94. Confidence reasoning: The cited line is plainly a search pattern against target-unpacked/res, not access to process environment data.
Keystore References Are Signing Examples
The scanner flagged certificate and keystore file references, but the cited lines show standard Android APK signing examples. They do not collect, expose, or transmit private keys. Confidence: 0.90. Confidence reasoning: The commands use local placeholder keystore names for signing rebuilt APKs, which matches apktool workflow documentation.
Device File Access Is Benign Error Redirection
The scanner flagged /dev/null access, but the line only suppresses missing-file errors while displaying network_security_config.xml. This is normal shell redirection and not device probing. Confidence: 0.96. Confidence reasoning: The command redirects stderr to /dev/null and reads a specific decoded APK XML file.
Weak Cryptography Patterns Dismissed
The scanner reported weak cryptography blocker matches at general prose lines, but those lines do not contain weak cryptographic operations. The RSA 2048 signing example is conventional Android signing guidance, not evidence of malicious weak-crypto use. Confidence: 0.88. Confidence reasoning: The cited static locations are descriptive text, and no insecure hash or encryption implementation appears there.

偵測到的模式

Command Examples With User-Controlled File PathsExecutable Analysis Script Pattern

審計版本 5

安全

Jan 16, 2026, 07:51 PM

This is a documentation-only skill containing instructional content for using apktool, a legitimate Android reverse engineering tool. All 97 static findings are false positives caused by markdown code examples showing bash commands for security analysis. The skill contains no executable code, only educational guidance for authorized security testing.

2
已掃描檔案
709
分析行數
3
發現
claude
審計單位
未發現安全問題

審計版本 4

安全

Jan 16, 2026, 07:51 PM

This is a documentation-only skill containing instructional content for using apktool, a legitimate Android reverse engineering tool. All 97 static findings are false positives caused by markdown code examples showing bash commands for security analysis. The skill contains no executable code, only educational guidance for authorized security testing.

2
已掃描檔案
709
分析行數
3
發現
claude
審計單位
未發現安全問題

審計版本 3

安全

Jan 10, 2026, 11:30 AM

Pure prompt-based skill containing only instructional content for using apktool. No executable code, no file system access, no network calls, no external command execution. The skill provides guidance for legitimate reverse engineering tasks including security analysis and vulnerability discovery.

1
已掃描檔案
529
分析行數
0
發現
claude
審計單位
未發現安全問題

審計版本 2

安全

Jan 10, 2026, 11:30 AM

Pure prompt-based skill containing only instructional content for using apktool. No executable code, no file system access, no network calls, no external command execution. The skill provides guidance for legitimate reverse engineering tasks including security analysis and vulnerability discovery.

1
已掃描檔案
529
分析行數
0
發現
claude
審計單位
未發現安全問題

審計版本 1

安全

Jan 10, 2026, 11:30 AM

Pure prompt-based skill containing only instructional content for using apktool. No executable code, no file system access, no network calls, no external command execution. The skill provides guidance for legitimate reverse engineering tasks including security analysis and vulnerability discovery.

1
已掃描檔案
529
分析行數
0
發現
claude
審計單位
未發現安全問題