CtrlK
BlogDocsLog inGet started
Tessl Logo

apk-redteam-pipeline

End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.

66

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-staged red-team pipeline with excellent concrete commands, but it suffers from inlined reference-worthy material and missing explicit validation checkpoints for its batch/destructive operations.

Suggestions

Extract the 60-pattern secret-grep catalog (Stage 3) and the Frida JS scripts (Stage 7) into reference files under references/ (e.g. grep-patterns.md, frida-scripts.js) and link to them, improving progressive disclosure.

Add explicit validation checkpoints for batch/destructive steps — e.g. verify a downloaded APK is a complete zip before decompiling, and confirm a recovered credential still authenticates before reporting it as a finding (mirrors the triage-validation 7-Question Gate already referenced).

Tighten the 'Related Skills & Chains' section — the per-skill chain-primitive prose is verbose; compress to one-line links to lift conciseness.

DimensionReasoningScore

Conciseness

The body is dense and action-oriented with no padding about what an APK is or how libraries work; minor verbosity appears in repeated anonymized engagement anecdotes and the lengthy 'Related Skills & Chains' prose, keeping it just below fully lean.

4 / 5

Actionability

Fully executable throughout — copy-paste ready curl/jadx/grep/openssl/frida commands with concrete regex patterns (e.g. 'AKIA[A-Z0-9]{16}', 'eyJ...') and complete Frida JS hooks covering the common cases.

5 / 5

Workflow Clarity

A clear 8-stage sequence plus a decision tree provides good ordering, but this batch/credential-spraying skill lacks explicit validation checkpoints or feedback loops (validate -> fix -> retry); the rubric caps destructive/batch workflows without validation at 3.

3 / 5

Progressive Disclosure

No references/scripts/assets bundle exists, so all content — including the 60-pattern grep catalog and Frida scripts that would naturally split into reference files — is inlined into one ~400-line SKILL.md; section headers give some structure but content that should be separate is inline.

3 / 5

Total

15

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capabilities and natural trigger conditions for a distinct Android red-team niche. The main weakness is engagement backstory padding that doesn't sharpen trigger quality or distinctiveness.

Suggestions

Trim or move the engagement narrative ('Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated...') out of the description — it inflates length without aiding trigger matching.

Add a file-extension or synonym trigger (e.g. 'when you find an .apk or .xapk file') to lift trigger-term coverage toward comprehensive.

Keep the 'Use when' clause but consider tightening the three triggers into a single comma-separated list to reduce verbosity.

DimensionReasoningScore

Specificity

The description enumerates many concrete actions — 'automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes' — giving comprehensive, specific coverage rather than vague language.

5 / 5

Completeness

It explicitly answers both 'what' (the full pipeline of capabilities) and 'when' (a concrete 'Use when...' clause with three distinct trigger scenarios), matching the top anchor.

5 / 5

Trigger Term Quality

'Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope' covers natural user phrasing well, though it lacks synonym/file-extension breadth (e.g. no '.apk' trigger) seen in the top anchor.

4 / 5

Distinctiveness Conflict Risk

The Android APK red-team niche is clearly distinct with low overlap risk, but the appended engagement backstory ('Built from an authorized external red-team engagement where 7 APKs were pulled manually...') adds narrative padding not relevant to distinctiveness, keeping it just below the cleanest anchor.

4 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

14

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.