← All skills
android-semantic-vuln-hunting
77 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By dreadnode/capabilities (GitHub) · security · 22 stars · scanned at commit 3ceeb34
Use when hunting Android APK logic bugs at scale — deep links, intent redirection, WebView trust, exported components, auth/session/client-state bypasses that scanners miss or flatten to generic warnings.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 19 places.
Show 16 more
- capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 181
for a in corpus/apks/*.apk; do - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 197
JAVA_OPTS="-Xmx6g" jadx --show-bad-code --no-debug-info -d findings/decompiled/<pkg> path/to.apk - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 225
bash scripts/run_class_rg.sh <CLASS> "$SRC" findings/<pkg>/ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 235
SRC=findings/decompiled/<pkg>/sources/<package> # narrow to first-party - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 270
rg -nl 'verified-it\.capitalone\.com' "$SRC" - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 290
rg -nl '"/vault"|"/mplesslogin"|"dashlane://"' "$SRC" - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 319
semgrep --config p/security-audit \ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 343
joern --script <(cat <<'EOF' - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 378
find findings/decompiled/<pkg>/resources/assets -maxdepth 1 \ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 391
BUNDLE=findings/decompiled/<pkg>/resources/assets/index.bundle - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 402
pipx install hbctool 2>/dev/null # one-time - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 449
find findings/decompiled/<pkg> -path '*lib/*/libapp.so' -o -name 'kernel_blob.bin' 2>/dev/null - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 461
blutter findings/decompiled/<pkg>/resources/lib/arm64-v8a/ findings/<pkg>/dart-analysis/ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 473
rg -nN -e 'safepalwallet' -e 'wc:' -e 'allowedHost' -e 'PATHS_TO' \ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 483
rg -n 'new C6.o\|new MethodChannel\|new EventChannel' findings/decompiled/<pkg>/sources \ - capabilities/android-apk-research/skills/android-semantic-vuln-hunting/SKILL.md, line 525
adb shell am start -a android.intent.action.VIEW \
Downloads and installs other software
The author does not mention this.
Found in 2 places.
Connects to the internet
The author does not mention this. Expected for a security skill.
Found in 4 places.
Show 1 more
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'android-semantic-vuln-hunting' ] || [ -L ~/.agents/skills/'android-semantic-vuln-hunting' ]; then echo 'A skill folder named android-semantic-vuln-hunting already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/dreadnode/capabilities' "$d" && git -C "$d" checkout --quiet '3ceeb34c0c33dc36738cf0d4ec86e38b53d98216' -- 'capabilities/android-apk-research/skills/android-semantic-vuln-hunting' && mkdir -p ~/.agents/skills && cp -R "$d"/'capabilities/android-apk-research/skills/android-semantic-vuln-hunting' ~/.agents/skills/'android-semantic-vuln-hunting' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'android-semantic-vuln-hunting' ~/.claude/skills/'android-semantic-vuln-hunting' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for dreadnode/capabilities shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/dreadnode/capabilities/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | 3ceeb34 | 77 |