Tribunal

An authorized-testing Android app pentest pipeline built as a small set of agentic skills. Drop an APK in apk/; every finding that survives static review, dynamic verification, and API testing goes through an adversarial prosecution/defense/judge trial before it's written up — no finding reaches report/ without standing up to cross-examination. Skills pass structured JSON through targets// and keep raw decompiled output (apktool/, jadx/) on disk for manual pivoting.

 APK ─▶ 1. decompile-threat-review ─▶ 2. dynamic-verify ─▶ 3. api-vuln-test ─▶ 4. courtroom-verdict
         (static, autonomous)          (your emulator+Burp)  (server-side API)   (prosecution/defense/judge)
         threat_model.json             evidence/, status      api_findings.json   report//-.md
         report.json (candidates)      frida/bypass.js

Authorized use only. apk/ is the scope boundary — an APK physically placed there is your own assertion that you own it or are authorized to test it. No package registry to maintain; scripts fail closed on the resolved path (see CLAUDE.md). Methodology + standard tooling only — writing a custom Frida pinning bypass for your own emulated app is expected; building tools that attack apps outside the apk/-is-scope model is not.

Requirements

• Python 3.10+ (bundled scripts; standard library only). Java (any recent JRE) to run apktool/jadx — vendored under tools/ (Windows + Linux launchers), no separate install needed; scripts prefer PATH if you already have your own.
• On PATH: adb, frida + frida-server (pip install frida-tools objection); Burp Suite and the Android Studio emulator for the dynamic stages. Scripts degrade gracefully if a tool is missing.

Run it like this

Clone the repo, drop an APK in apk/, and trigger the pipeline — that's the whole setup. Under the hood:

# 1. Decompile (scope-checks the path against apk/ automatically) + build the threat model
python skills/decompile-threat-review/scripts/inventory.py --apk apk/app.apk
#    -> targets//{apktool,jadx}/, inventory.json, evidence/, frida/
#    Then a main agent fans out subagents (default, not opt-in) -- one builds the structural
#    threat model, four review disjoint rubric slices in parallel, skeptics try to refute each
#    candidate -- and writes targets//t