It introduces a courtroom-style adjudication process where prosecution/defense/judge verify each finding, reducing false positives, and it is fully agent-driven with structured skills that pass JSON between stages.
An authorized-testing Android app pentest pipeline built as a small set of agentic skills.
Drop an APK in apk/; every finding that survives static review, dynamic verification, and API
testing goes through an adversarial prosecution/defense/judge trial before it's written up — no
finding reaches report/ without standing up to cross-examination. Skills pass structured JSON
through targets// and keep raw decompiled output (apktool/, jadx/) on disk for
manual pivoting.
APK ─▶ 1. decompile-threat-review ─▶ 2. dynamic-verify ─▶ 3. api-vuln-test ─▶ 4. courtroom-verdict
(static, autonomous) (your emulator+Burp) (server-side API) (prosecution/defense/judge)
threat_model.json evidence/, status api_findings.json report//-.md
report.json (candidates) frida/bypass.js
Authorized use only.
apk/is the scope boundary — an APK physically placed there is your own assertion that you own it or are authorized to test it. No package registry to maintain; scripts fail closed on the resolved path (seeCLAUDE.md). Methodology + standard tooling only — writing a custom Frida pinning bypass for your own emulated app is expected; building tools that attack apps outside theapk/-is-scope model is not.
apktool/jadx — vendored under tools/ (Windows + Linux launchers), no separate install
needed; scripts prefer PATH if you already have your own.adb, frida + frida-server (pip install frida-tools objection); Burp Suite
and the Android Studio emulator for the dynamic stages. Scripts degrade gracefully if a
tool is missing.Clone the repo, drop an APK in apk/, and trigger the pipeline — that's the whole setup. Under
the hood:
# 1. Decompile (scope-checks the path against apk/ automatically) + build the threat model
python skills/decompile-threat-review/scripts/inventory.py --apk apk/app.apk
# -> targets//{apktool,jadx}/, inventory.json, evidence/, frida/
# Then a main agent fans out subagents (default, not opt-in) -- one builds the structural
# threat model, four review disjoint rubric slices in parallel, skeptics try to refute each
# candidate -- and writes targets//t
Similar projects matched by category, topics, and programming language.
Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.
Kimi K3 is an open-weight, 2.8T-parameter native multimodal agentic model with a 1M-token context window, designed for frontier coding, knowledge work, and reasoning tasks.
A browser-based first-person shooter built entirely with procedural generation and orchestrated AI agents, featuring 55k lines of Three.js/WebGL2 code and no art assets.