This repository also configures its own agents. See what Tribunal tells them →
Skill Claude CodeCodex
The app is a doorway to the API — where the biggest bounties live. Fires on server-side signals discovered through the app: API endpoints/hosts in secrets.json (httpendpoint, firebasedb, s3bucket, gcsbucket categories), Authorization/Bearer headers, GraphQL endpoints, JWTs, object IDs (id/uuid/filename) in requests…
Skill Claude CodeCodex
First-pass recon net for an Android APK — hunt secrets, insecure storage, weak crypto, broken TLS, and risky configuration in one broad sweep. Fires on manifest signals (android:debuggable="true", android:allowBackup="true", android:usesCleartextTraffic="true", a networkSecurityConfig that trusts user CAs or permits…
Skill Claude CodeCodex
Test Android client-side code-execution and dangerous-sink vulnerabilities for bug bounty — untrusted data reaching a code-loading, deserialization, reflection, native-load, or file-race sink. Fires on source signals (DexClassLoader / PathClassLoader / InMemoryDexClassLoader, System.load / System.loadLibrary from an…
Skill Claude CodeCodex
Test Android deep links & URL handling for bug bounty — custom URL schemes, Android App Links, and OAuth/magic-link redirects that a browser or another app can drive one-click. Fires on manifest signals (an with category BROWSABLE, android:scheme=, android:host/pathPrefix/pathPattern, android:autoVerify="true", a…
Skill Claude CodeCodex
Audit an Android app's bundled third-party dependencies / SDKs for known-vulnerable, malicious, or PII-leaking libraries (bug bounty, catalog Sec.10 + the Sec.13 tracker/PII row). Fires on bundled-artifact signals (lib/ /.so native libraries, third-party smali package roots like com/google/…
Skill Claude CodeCodex
Test exported/unguarded Android IPC components for bug bounty — exported Activities, Services, Broadcast Receivers, and Content Providers reachable by any app. Fires on manifest signals (android:exported="true", an with no exported attr, missing/normal android:permission, exported provider with authorities…
Skill Claude CodeCodex
Test implicit-intent and broadcast leaks for Android bug bounty — sensitive data sent to any app via unprotected/implicit Intents, interceptable broadcasts, and hijackable PendingIntents. Fires on source signals (sendBroadcast/sendOrderedBroadcast with no setPackage()/permission, sendStickyBroadcast, new…
Skill Claude CodeCodex
Test client-side / on-device authentication that can be bypassed locally for bug bounty — biometric/fingerprint prompts, app-lock PINs, and device-recoverable session tokens (catalog §4). Fires on static signals (BiometricPrompt or FingerprintManager used WITHOUT a CryptoObject, authenticate() called with no crypto…
Skill Claude CodeCodex
Audit bundled Android native libraries and the JNI boundary for bug bounty — memory corruption (buffer overflow / use-after-free), RCE/ACE via native or JNI flaws, and unvalidated data crossing Java native. Fires on signals: a bundled lib/ /.so (arm64-v8a, armeabi-v7a, x8664), System.loadLibrary / System.load, native…
Skill Claude CodeCodex
Test Android WebView vulnerabilities for bug bounty — the surface where XSS, local file theft, SSRF, and even RCE converge. Fires on source signals (addJavascriptInterface, @JavascriptInterface, setJavaScriptEnabled(true), setAllowFileAccess, setAllowUniversalAccessFromFileURLs, setAllowFileAccessFromFileURLs…
Skill Claude CodeCodex
Test the app's backend API surface once traffic flows through Burp — where the biggest mobile bounties live. Enumerates endpoints from threatmodel.json (static) + Burp history (dynamic), then tests for IDOR/BOLA, broken auth/session, broken access control (BFLA), injection, and business-logic flaws by reasoning over…
Skill Claude CodeCodex
Put every status:"confirmed" finding (client-side, from dynamic-verify, or server-side, from api-vuln-test) on trial before it becomes a written report. A prosecution subagent argues it's real and exploitable (reading the evidence itself), a defense subagent reads that argument plus the same evidence and argues the…
Skill Claude CodeCodex
Decompile an Android APK, then have a main agent fan out subagents to autonomously build a threat model and find candidate vulnerabilities — no deterministic sink-grep in the loop. THE first step of an app pentest. Fires on: "decompile this APK", "reverse this app", "look inside the apk", "what's the attack surface"…
Skill Claude CodeCodex
Verify a decompile-threat-review report against the running app on YOUR Android emulator. Installs + launches the APK, wires the emulator through Burp (proxy + CA), and gets traffic flowing — including defeating SSL pinning: try generic Objection/Frida unpinning first, and if that fails, read the pinning…
Skill Claude CodeCodex
End-to-end, fully autonomous Android app pentest runbook: drive decompile-threat-review -> dynamic-verify -> api-vuln-test -> courtroom-verdict for one APK, back-to-back with no manual gate in between, passing structured JSON through targets/ /. Fires on: "pentest this app", "start the engagement", "go end to end"…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: