Apk Decompiler

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:03 AM UTC
• Version: 1.0.0

Overview

This APK reverse-engineering skill is mostly transparent, but it downloads and runs persistent third-party tools without integrity checks and can report APK signing success when signing failed.

Install only if you are comfortable with a Review-level tool that downloads and executes third-party APK tooling on your machine. Use it in a sandbox or disposable workspace, pin and verify tool hashes yourself, keep TOOLS_DIR under your control, process only APKs you are authorized to inspect or modify, and independently verify rebuilt APK signatures before installing or sharing them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup_tools.sh:20

Finding

Unverified Remote Tool Downloads Enable Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_tools.sh, lines 20-55
Vulnerability Type: Unverified remote executable dependency retrieval
Risk Level: High

Vulnerable Code

bash

# 下载 baksmali (DEX -> Smali)
if [ ! -f "$TOOLS_DIR/baksmali.jar" ]; then
    echo "📥 下载 baksmali..."
    curl -L -o "$TOOLS_DIR/baksmali.jar" \
        "https://bitbucket.org/JesusFreke/smali/downloads/baksmali-2.5.2.jar"
fi

# 下载 smali (Smali -> DEX)
if [ ! -f "$TOOLS_DIR/smali.jar" ]; then
    echo "📥 下载 smali..."
    curl -L -o "$TOOLS_DIR/smali.jar" \
        "https://bitbucket.org/JesusFreke/smali/downloads/smali-2.5.2.jar"
fi

# 下载 apktool (资源解码)
if [ ! -f "$TOOLS_DIR/apktool.jar" ]; then
    echo "📥 下载 apktool..."
    curl -L -o "$TOOLS_DIR/apktool.jar" \
        "https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.10.0.jar"
fi

# 下载 dex2jar (DEX -> JAR)
if [ ! -f "$TOOLS_DIR/dex2jar.zip" ]; then
    echo "📥 下载 dex2jar..."
    curl -L -o "$TOOLS_DIR/dex2jar.zip" \
        "https://github.com/pxb1988/dex2jar/releases/download/v2.4/dex-tools-v2.4.zip"
    cd "$TOOLS_DIR"
    unzip -o dex2jar.zip
    mv dex-tools-v2.4 dex2jar
    chmod +x dex2jar/*.sh
fi

# 下载 uber-apk-signer (APK 签名)
if [ ! -f "$TOOLS_DIR/uber-apk-signer.jar" ]; then
    echo "📥 下载 uber-apk-signer..."
    curl -L -o "$TOOLS_DIR/uber-apk-signer.jar" \
        "https://github.com/patrickfav/uber-apk-signer/releases/download/v1.3.0/uber-apk-signer-1.3.0.jar"
fi

Technical Analysis

The setup script retrieves JAR files and an archive containing executable shell scripts from third-party hosting services. Although the URLs use HTTPS and pin release versions, the script does not validate cryptographic hashes or publisher signatures before storing, extracting, marking executable, and subsequently using these artifacts.

The flagged dex2jar URL is a GitHub release associated with the decla ...[truncated 2319 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish a trusted SHA-256 or stronger digest for every exact dependency version.

2. Download each artifact into a newly created temporary directory and verify its digest before moving it into TOOLS_DIR.

3. When upstream projects provide signed releases, verify signatures against pinned publisher keys.

4. Use strict curl behavior, such as:

   bash

   curl --fail --show-error --silent --location \
       --proto '=https' --tlsv1.2 \
       -o "$temporary_file" "$url"
   

5. Restrict redirects to HTTPS and, where practical, to an approved host set.

6. Reject archive entries containing absolute paths or parent-directory traversal before extraction.

7. Extract archives into a temporary directory and validate the expected directory structure before installation.

8. Do not mark downloaded files executable until all integrity and structure checks have passed.

9. Prefer trusted operating-system packages or vendored, reviewed artifacts where licensing and maintenance permit.

10. Execute reverse-engineering tools in a sandbox or container with no unnecessary network access, secrets, or writable host directories.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rebuild.py:65

Finding

APK Signing Failures Are Suppressed and Reported as Success

Content

View full analysis

Vulnerability Details

File Location: scripts/rebuild.py, lines 65-90
Vulnerability Type: Improper error handling and missing output verification
Risk Level: Medium

Vulnerable Code

python

signer = os.path.join(TOOLS_DIR, 'uber-apk-signer.jar')

if not os.path.exists(signer):
    print("⚠️ uber-apk-signer 未安装，尝试使用 apksigner...")
    # 尝试使用系统 apksigner
    result = subprocess.run(
        ['apksigner', 'sign', '--ks', 'debug.keystore',
         '--ks-pass', 'pass:android', '--out', signed_apk, apk_path],
        capture_output=True, text=True
    )
else:
    result = subprocess.run(
        ['java', '-jar', signer, '--apks', apk_path,
         '--out', os.path.dirname(signed_apk) or '.'],
        capture_output=True, text=True
    )

if result.returncode != 0:
    print(f"⚠️ 签名警告: {result.stderr[:200]}")
    # uber-apk-signer 可能已自动签名

print(f"  ✅ 签名完成")
return True

Technical Analysis

The sign_apk function returns True and prints a success message regardless of the signer process's exit status. A nonzero exit code is treated only as a warning. The function also does not verify that the expected output was created or that the resulting APK has a valid signature.

The comment suggesting that uber-apk-signer may have generated an output does not establish success. Moreover, the requested signed_apk filename is passed directly to apksigner, while uber-apk-signer receives only an output directory and may choose its own output name. This makes explicit discovery and verification of the actual signed artifact necessary.

A signing failure can therefore leave an unsigned APK, an old output from a previous run, or an APK signed with an unintended key while the workflow reports completion. This undermines the integrity guarantees expected from the declared rebuild-and-sign functionality.

Attack Path

1. A malformed APK, unavailable signer, missing debug keystore, c ...[truncated 1163 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every nonzero signer exit code as a failure:

   python

   if result.returncode != 0:
       print(f"Signing failed: {result.stderr}")
       return False
   

2. Determine the exact output path produced by each signer rather than assuming that a file was generated.

3. Remove or isolate pre-existing output files before signing so stale artifacts cannot be mistaken for new results.

4. Verify that the expected signed file exists, is a regular file, and was created or modified during the current operation.

5. Validate the resulting signature with apksigner verify --verbose --print-certs or an equivalent trusted verifier.

6. Confirm that the signing certificate fingerprint matches the intended debug or release certificate.

7. Propagate False from sign_apk to main() and terminate with a nonzero exit status.

8. Print the exact verified output path and certificate identity only after verification succeeds.

9. Avoid embedding a predictable keystore password in the command line for non-test use; obtain release credentials through an appropriate secret-management mechanism.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims powerful APK decompilation, modification, rebuilding, signing, and component-analysis capabilities that static analysis indicates are not actually implemented or are only approximated. This mismatch is dangerous because users or downstream agents may rely on incomplete or inaccurate output when making security, reverse-engineering, or deployment decisions, leading to unsafe modifications or false conclusions about APK contents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and instructs shell execution, file access, and environment-variable use, but does not declare any tool scope such as allowed-tools or permissions. This creates an authorization and transparency gap: an agent or user may invoke broader capabilities than expected, making misuse or unintended command execution harder to govern and audit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup instructions download third-party tooling and place it under the user's home directory, but the skill does not clearly warn about this side effect up front. Downloading executables or JARs from external sources without prominent disclosure increases supply-chain and persistence risk, especially in agent-driven environments where users may not realize software is being installed outside the project directory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The rebuild/sign workflow produces a modified, installable APK, but the skill does not prominently warn that this artifact can materially affect app and device state if installed or distributed. In the context of an APK reverse-engineering skill, this is especially sensitive because the tool is explicitly designed to alter application logic and create runnable packages, which can enable accidental misuse or repackaging abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document demonstrates adding sensitive permissions such as CAMERA and WRITE_EXTERNAL_STORAGE without explaining least-privilege requirements, user privacy implications, or platform restrictions. In the context of APK modification, this can facilitate repackaging apps with expanded capabilities, making it easier to create invasive or trojanized builds that access device data or hardware unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly shows enabling android:usesCleartextTraffic="true" but gives no warning that this allows unencrypted HTTP traffic, increasing exposure to interception, tampering, and privacy leakage on untrusted networks. In an APK reverse-engineering/modification skill, this is more dangerous because users are being taught to alter app security properties and may copy the snippet directly into rebuilt apps.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s docstrings, CLI help text, and printed status/error messages are all written in Chinese, which imposes a specific language on users. Under the policy, language constraints should either be optional/opt-in or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring at L022 and the module header at L007-L010 describe manifest extraction, permissions analysis, and component listing as if they come from the AndroidManifest. In reality, extract_manifest_info opens DEX files and heuristically searches strings for permission names and activity-like class names, leaving declared manifest fields such as package, version, SDK levels, services, receivers, and providers unparsed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description, help strings, examples, and runtime output are presented only in Chinese. This is a natural-language policy concern because the tool does not offer the user a choice of language or state a justified locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language documentation and CLI help text that force a specific language for usage, status, and error messages. Under the policy, a language-specific constraint should either be optional for the user or clearly documented as a justified locale-specific tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/decompile.py (reported line 46)May include surrounding context.

python

os.makedirs(extracted_dir, exist_ok=True)
    
    # 使用 unzip 解压
    result = subprocess.run(
        ['unzip', '-o', apk_path, '-d', extracted_dir],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

This command runs baksmali.jar from TOOLS_DIR, which comes from an environment variable and is not validated. If that path is attacker-influenced, the script will execute a malicious JAR and grant arbitrary code execution under the user's account.

Content

Scanner excerpt · scripts/decompile.py (reported line 70)May include surrounding context.

python

print(f"  处理: {dex_file.name}")
        
        result = subprocess.run(
            ['java', '-jar', os.path.join(TOOLS_DIR, 'baksmali.jar'),
             'd', str(dex_file), '-o', out_dir],
            capture_output=True, text=True

Tainted flow: 'TOOLS_DIR' from os.environ.get (line 19, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 99% confidence

Finding

This is a true vulnerability: TOOLS_DIR is attacker-influenced and used to locate baksmali.jar for execution. Because the skill's purpose is to decompile untrusted APKs and invoke external tooling, any path-hijack of those tools has direct arbitrary-code-execution impact on the analyst's machine.

Content

Scanner excerpt · scripts/decompile.py (reported line 70)May include surrounding context.

python

print(f"  处理: {dex_file.name}")
        
        result = subprocess.run(
            ['java', '-jar', os.path.join(TOOLS_DIR, 'baksmali.jar'),
             'd', str(dex_file), '-o', out_dir],
            capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

This command executes a JAR from TOOLS_DIR, and TOOLS_DIR is derived from an environment variable without trust validation. If an attacker can influence the environment or place a malicious apktool.jar in that directory, the script will run arbitrary code via java -jar.

Content

Scanner excerpt · scripts/decompile.py (reported line 87)May include surrounding context.

python

"""使用 apktool 解码资源"""
    print("📄 解码资源文件...")
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'apktool.jar'),
         'd', apk_path, '-o', os.path.join(output_dir, 'apktool-out'),
         '-f', '-s'],  # -f 强制覆盖, -s 不反编译源码

Tainted flow: 'TOOLS_DIR' from os.environ.get (line 19, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 99% confidence

Finding

This is a genuine tainted-path-to-execution issue: TOOLS_DIR comes from os.environ and is concatenated into the path of apktool.jar passed to java -jar. In the context of an APK reverse-engineering skill that routinely executes helper tooling, this makes environment manipulation especially dangerous because it turns normal workflow into arbitrary code execution.

Content

Scanner excerpt · scripts/decompile.py (reported line 87)May include surrounding context.

python

"""使用 apktool 解码资源"""
    print("📄 解码资源文件...")
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'apktool.jar'),
         'd', apk_path, '-o', os.path.join(output_dir, 'apktool-out'),
         '-f', '-s'],  # -f 强制覆盖, -s 不反编译源码

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script executes d2j_cmd from a path ultimately rooted in TOOLS_DIR, which is environment-controlled. An attacker who can modify that environment variable or the referenced dex2jar files can cause arbitrary program execution when the --java option is used.

Content

Scanner excerpt · scripts/decompile.py (reported line 118)May include surrounding context.

python

jar_output = os.path.join(output_dir, f'{Path(apk_path).stem}-dex2jar.jar')
    
    result = subprocess.run(
        [d2j_cmd, apk_path, '-o', jar_output, '--force'],
        capture_output=True, text=True
    )

Tainted flow: 'd2j_cmd' from os.environ.get (line 114, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 99% confidence

Finding

This is a real code-execution risk because d2j_cmd is selected from a directory rooted in TOOLS_DIR, which can be attacker-controlled via the environment. The script then directly executes that script/batch file, allowing straightforward arbitrary command execution if the tool directory is replaced or poisoned.

Content

Scanner excerpt · scripts/decompile.py (reported line 118)May include surrounding context.

python

jar_output = os.path.join(output_dir, f'{Path(apk_path).stem}-dex2jar.jar')
    
    result = subprocess.run(
        [d2j_cmd, apk_path, '-o', jar_output, '--force'],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/decompile.py (reported line 139)May include surrounding context.

python

}
    
    # 解压获取基本信息
    result = subprocess.run(
        ['unzip', '-l', apk_path],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rebuild.py (reported line 29)May include surrounding context.

python

print(f"❌ Smali 目录不存在: {smali_dir}")
        return False
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'smali.jar'),
         'a', smali_dir, '-o', output_dex],
        capture_output=True, text=True

Tainted flow: 'TOOLS_DIR' from os.environ.get (line 19, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 91% confidence

Finding

TOOLS_DIR is taken from an environment variable and used to select the JAR executed by Java. If an attacker can influence the process environment, they can point TOOLS_DIR to a malicious smali.jar and obtain arbitrary code execution under the privileges of the script.

Content

Scanner excerpt · scripts/rebuild.py (reported line 29)May include surrounding context.

python

print(f"❌ Smali 目录不存在: {smali_dir}")
        return False
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'smali.jar'),
         'a', smali_dir, '-o', output_dex],
        capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rebuild.py (reported line 46)May include surrounding context.

python

"""使用 apktool 重新打包"""
    print("📦 重新打包 APK...")
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'apktool.jar'),
         'b', project_dir, '-o', output_apk],
        capture_output=True, text=True

Tainted flow: 'TOOLS_DIR' from os.environ.get (line 19, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 91% confidence

Finding

This code executes apktool.jar from a path derived from TOOLS_DIR, which is environment-controlled. In any environment where a caller, wrapper script, CI job, or another local actor can set TOOLS_DIR, the script may run an attacker-supplied JAR and execute arbitrary code.

Content

Scanner excerpt · scripts/rebuild.py (reported line 46)May include surrounding context.

python

"""使用 apktool 重新打包"""
    print("📦 重新打包 APK...")
    
    result = subprocess.run(
        ['java', '-jar', os.path.join(TOOLS_DIR, 'apktool.jar'),
         'b', project_dir, '-o', output_apk],
        capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rebuild.py (reported line 74)May include surrounding context.

python

if not os.path.exists(signer):
        print("⚠️ uber-apk-signer 未安装，尝试使用 apksigner...")
        # 尝试使用系统 apksigner
        result = subprocess.run(
            ['apksigner', 'sign', '--ks', 'debug.keystore',
             '--ks-pass', 'pass:android', '--out', signed_apk, apk_path],
            capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/rebuild.py (reported line 80)May include surrounding context.

python

capture_output=True, text=True
        )
    else:
        result = subprocess.run(
            ['java', '-jar', signer, '--apks', apk_path,
             '--out', os.path.dirname(signed_apk) or '.'],
            capture_output=True, text=True

Tainted flow: 'signer' from os.environ.get (line 69, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 89% confidence

Finding

The signer path is built from TOOLS_DIR and then executed as a Java JAR if present. Because this tool is specifically designed to process and modify APKs, arbitrary code execution through a malicious signer JAR is especially dangerous in analyst workstations or CI pipelines handling untrusted samples.

Content

Scanner excerpt · scripts/rebuild.py (reported line 80)May include surrounding context.

python

capture_output=True, text=True
        )
    else:
        result = subprocess.run(
            ['java', '-jar', signer, '--apks', apk_path,
             '--out', os.path.dirname(signed_apk) or '.'],
            capture_output=True, text=True

Static analysis

No suspicious patterns detected.