Mobile Android

---
name: Mobile Android Whitebox Audit
description: Use this skill when the user is auditing a decompiled Android application — directory structure includes `jadx_out/` / `apktool_out/`, files end in `.smali` / are jadx-renamed to `defpackage/*.java`, or the conversation mentions an APK / xAPK / `com.example.*` package. Covers the high-signal vulnerability classes vuln-scout detects in decompiled APKs and the conventions for running the unified mobile-audit workflow.
version: 1.0.0
---

# Mobile Android Whitebox Audit

## When this skill applies

The user is reviewing a decompiled Android target. Signals to look for:

- The working directory or referenced target contains `jadx_out/`, `jadx_out2/`,
  `apktool_out/`, `AndroidManifest.xml`, `*.smali`, or jadx's signature
  `defpackage/*.java` files (obfuscated default-package classes).
- The user mentions an APK, xAPK, or an Android package name
  (`com.example.*`, `com.acme.app`, etc.).
- A previous run produced findings under `<target>/.claude/findings.json` whose
  `type` starts with `mobile-*`.

## Workflow: prefer `/vuln-scout:mobile-audit`

For Android targets, the regular `/vuln-scout:scan` only sees one of the two
decompilation trees (code OR resources). Use the unified driver instead:

```
/vuln-scout:mobile-audit <target-root>
```

The driver auto-discovers `jadx_out/sources` (or `jadx/sources`,
`decompiled/sources`, `android-decompiled/sources`, `src/main/java`) for code
findings and `apktool_out` (or `apktool`, `res`) for manifest + NSC findings,
runs the orchestrator on each, and merges the artifacts into a single
`<target>/.claude/findings.json`. Use the `--profile deep` flag when CodeQL /
Joern are installed (run `python3 vuln-scout/scripts/doctor.py` to confirm).

## High-signal detector cheatsheet

VulnScout ships dedicated mobile detectors. Each produces normalized findings
with the standard schema (`stable_key`, `kind`, `severity`, `type`, etc.).

| Detector | Type slug | What it finds |
|---|---|---|
| `detect_webview_js_injection` | `mobile-webview-js-injection` | A `<script>` block or `var X =` JS literal assembled from native StringBuilder/helper calls — the in-WebView card-tokenization shape. Dispatched via `evaluateJavascript` somewhere in the call graph. |
| `detect_webview_unsafe_config` | `mobile-webview-file-access`, `mobile-webview-js-interface` | `setJavaScriptEnabled(true)` + `setAllowFileAccess(true)` / `addJavascriptInterface()`. |
| `detect_remote_controlled_url` | `mobile-remote-controlled-endpoint` | URL fetched from a config key (`getString("*_URL"...)`) and dispatched via OkHttp/Retrofit/`CoroutineCallFactory` — the remote-config URL-injection shape. |
| `detect_network_security_config_gaps` | `mobile-nsc-no-pinning`, `mobile-nsc-narrow-pinning`, `mobile-nsc-cleartext` | Missing or partial cert pinning, cleartext traffic permitted. |
| `detect_android_manifest_issues` | `mobile-exported-component-no-permission`, `mobile-debuggable-build` | Exported activity/service/receiver with no permission guard; debuggable production build. |
| `detect_android_storage_backup_issues` | `mobile-allow-backup-true`, `mobile-exported-provider`, `mobile-deeplink-host-wildcard` | allowBackup=true; exported ContentProviders without permission; wildcard deeplink hosts. |
| `detect_insecure_crypto` | `mobile-insecure-crypto`, `mobile-insecure-random` | AES default mode (ECB) / DES / 3DES / RC4 / MD5 / SHA-1 / HmacMD5; `Math.random()` / `new Random()` used for tokens/IVs/keys. |
| `detect_sensitive_sharedprefs` | `mobile-shared-prefs-sensitive` | Tokens / passwords / JWTs / PANs written to non-Encrypted SharedPreferences. |
| `detect_log_sensitive_data` | `mobile-log-sensitive` | `Log.X` call interpolating a variable whose name maps to a sensitive identifier. |
| `detect_insecure_tls` | `mobile-insecure-tls` | Empty `checkServerTrusted` / always-true `HostnameVerifier`. |
| `detect_mobile_intent_redirection` | `mobile-intent-redirection` | Activity re-launches an externally provided Intent (StrandHogg shape). |
| `detect_pendingintent_mutable` | `mobile-pendingintent-mutable` | `PendingIntent.get*` with `FLAG_MUTABLE`. |
| `detect_hardcoded_secrets_simple` | `secret-hardcoded`, `secret-private-key` | AKIA / sk_live_ / ghp_ / xoxb / `-----BEGIN PRIVATE KEY-----` blocks. |

## Triage shortcuts

When `findings.json` is heavy, sort by these priorities first:

1. `mobile-webview-js-injection` + `mobile-remote-controlled-endpoint` in the
   same package — that's a complete chain (server-influenced data flows into
   JS that runs in a privileged WebView).
2. `mobile-insecure-tls` + `mobile-nsc-no-pinning` — MITM precondition holds
   for the entire app.
3. `mobile-shared-prefs-sensitive` in an auth/identity package.
4. `mobile-exported-component-no-permission` on receivers/services that pass
   intents into payment, auth, or deeplink handlers.

## Calibration anchors

If a code change to detectors needs validation, run against a decompiled
target with both `jadx_out/sources/` and `apktool_out/` present. A healthy
mobile target with a payment-tokenization flow should produce roughly:

- Total findings: 7–30 (mix of high/medium, plus a handful of hotspots)
  depending on profile and how much obfuscated SDK code lives under
  `defpackage/`
- Must include at least:
  - `mobile-remote-controlled-endpoint` on a `*TokenizeCardApi`-style class
    where a `*_URL` key is read from config and dispatched
  - `mobile-webview-js-injection` on a payment package class that splices
    native values into a `<script>` literal
  - `mobile-nsc-narrow-pinning` at
    `apktool_out/res/xml/network_security_config.xml` whenever pinning is
    declared but the pin-set is narrower than the app's API surface

## Path-exclusion conventions

`vuln_class_detectors.py` strips findings inside well-known third-party paths
to keep noise out of decompiled APKs:

- Single-segment, root-only: `kotlin`, `kotlinx`, `java`, `javax`, `androidx`,
  `okhttp3`, `retrofit2`, `okio`, `dagger`, `tslib`, `j$` …
- Multi-segment, anywhere: `com/google/android/*`, `com/google/firebase/*`,
  `com/squareup/*`, `com/bumptech/glide/*`, `com/lexisnexisrisk/*`,
  `io/reactivex/*`, `io/sentry/*`, `org/maplibre/*` …

Default-package classes (`defpackage/jh5.java` style) cannot be excluded by
path — review their content if a finding lands there.