Skip to content

Releases: poll-poll134/android-blackbox-analysis-skill

Release list

v0.1.1 — Security and Distribution Hardening

v0.1.1 — Security and Distribution Hardening Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Aug 17:12
v0.1.1
ec90d5e

v0.1.1 — Security and Distribution Hardening

This release hardens the existing Android black-box analysis workflow without expanding its authorization scope.

Changes

  • Documents the trust boundary around untrusted app-rendered text, ADB output, case files, contributions, dependencies, and release assets.
  • Neutralizes formula-like UI text before writing CSV indexes.
  • Rejects unsafe package names, case roots, symlinks, oversized UI/text input, and unbounded sweep or wait parameters.
  • Adds negative tests for injection-shaped UI content, hostile arguments, symlink escapes, credential patterns, and resource exhaustion.
  • Adds deterministic installable ZIP packaging and a SHA-256 checksum.
  • Adds CodeQL/Dependabot configuration, CODEOWNERS, and structured public intake forms that prohibit private evidence.

Verification

  • ./scripts/smoke_test.sh
  • ./tests/security_negative_test.sh
  • node ./scripts/validate_skill.mjs .
  • node ./scripts/validate_example.mjs ./examples/sanitized-complete-example
  • node ./scripts/redact_check.mjs .
  • unpacked release archive validation on macOS and GitHub Actions Ubuntu 24.04

Known limits

CI validates scripts and synthetic fixtures, not every Android device, distribution, renderer, or third-party application. Redaction remains heuristic and cannot inspect sensitive pixels. ADB is privileged and must be restricted to explicitly authorized devices and networks. No third-party public adoption is claimed by this release.

Installation

Download both release assets, verify the checksum, and extract the ZIP into the active Codex Skills directory. Git-based installation remains supported.

Assets 4
Loading

v0.1.0 — First Public Release

v0.1.0 — First Public Release

Choose a tag to compare

View all tags
@poll-poll134 poll-poll134 released this 11 Aug 15:08
v0.1.0
c4cb7f9

v0.1.0 — 首个公开版本 / First Public Release

这是 Android App Black-Box Analysis Skill 的首个公开版本。它把长期个人使用的 Android 黑盒分析工具链通用化并完成隐私清理，提供从范围定义、证据采集到结构化索引和人工报告的完整基础能力。

功能

  • 通过 ADB 采集截图、原始截图、UI hierarchy 和可选 Android 运行时信息。
  • 保留截图实际格式、分辨率、字节数与 SHA-256，支持预期尺寸门禁。
  • 为页面、状态、弹窗和长页分配稳定证据 ID，并支持长页连续采集。
  • 精确点击默认 dry-run，只有显式 --execute 才会执行。
  • 自动生成 screenshot_index.csv、interface_index.csv、control_coverage.csv 和 coverage_gaps.csv。
  • 提供能力矩阵、系统接口证据表和最终报告模板，区分观察、计算、推论、未测试和范围外结论。
  • 提供 Smoke Test、Skill 结构校验和文本脱敏扫描。
  • 提供中英文 README、安全政策、贡献指南，以及只读权限的 GitHub Actions。
  • 新增完整脱敏示例，展示输入、证据索引、覆盖缺口、能力归纳、系统边界和最终报告。示例完全合成，不对应真实应用或用户。

测试平台

  • macOS 26.6.1 arm64：Bash 3.2.57、Node.js 22.21.1、Python 3.9.6；三个现有校验命令全部通过。
  • GitHub Actions Ubuntu 24.04.4：Smoke Test、Skill 结构校验和仓库脱敏扫描全部通过；工作流仅有 contents: read 权限，不需要 ADB 或 secrets。
  • 实际采集使用边界：本仓库的私人前身曾用于 Android 10 / API 29、720 × 1280 的远程 ADB 容器环境，处理过 JPEG 截图输出、UI hierarchy 不完整、无相机和网络中断续扫等情况。该实践不等于公开仓库已完成所有 Android、Linux 或设备类型的矩阵测试。

已知限制

  • Linux 已验证脚本级 CI，但真实 Android 设备采集尚未覆盖多个 Linux 发行版；Windows 仅建议通过 WSL2 使用，未验证原生 PowerShell/CMD。
  • WebView、Canvas、游戏和自定义渲染界面可能没有完整 UI hierarchy，必须以截图证据和覆盖缺口共同说明。
  • 工具生成证据和模板，不会自动完成最终产品判断；最终报告需要人工基于证据 ID 归纳。
  • redact_check.mjs 是文本启发式检查，不识别截图中的账号、头像、地址，也不能保证覆盖 UI XML、设备标识或所有敏感格式；发布前仍需人工复核。
  • 不自动完成真实登录、支付、验证码、账号删除、外部消息或其他高风险与不可逆操作。
  • 不用于 APK 反编译、源码审计、协议逆向、绕过风控或恢复加密流量中的私有 API。
  • 完整脱敏示例是文档型合成公开导出，不是可重放的真实设备 fixture，也不能作为任何产品事实引用。

安装与升级

全新安装并固定到 v0.1.0：

mkdir -p ~/.codex/skills
git clone --branch v0.1.0 --depth 1 \
  https://github.com/poll-poll134/android-blackbox-analysis-skill.git \
  ~/.codex/skills/android-app-blackbox-competitive-analysis

已有基于 main 的安装升级到本版本：

git -C ~/.codex/skills/android-app-blackbox-competitive-analysis switch main
git -C ~/.codex/skills/android-app-blackbox-competitive-analysis pull --ff-only
cd ~/.codex/skills/android-app-blackbox-competitive-analysis
./scripts/smoke_test.sh

需要精确固定到发布标签：

git -C ~/.codex/skills/android-app-blackbox-competitive-analysis fetch --tags
git -C ~/.codex/skills/android-app-blackbox-competitive-analysis switch --detach v0.1.0

升级后请新建 Codex 任务或重启客户端，让 Skills 目录重新加载。

This is the first public release of Android App Black-Box Analysis Skill. It provides evidence-first ADB capture, stable evidence IDs, screenshot and UI indexes, coverage-gap reporting, analysis templates, redaction checks, bilingual documentation, community health files, and read-only GitHub Actions validation.

Testing covers macOS 26.6.1 arm64 locally and script-level CI on GitHub Actions Ubuntu 24.04.4. The private predecessor has also been used with a remote Android 10 / API 29 container at 720 × 1280, but this does not constitute a complete device or Linux distribution matrix.

Known limitations include incomplete UI hierarchies for custom-rendered surfaces, manual final analysis, heuristic text-only redaction, no automatic high-risk account or payment operations, and no APK decompilation or private-API recovery. The bundled end-to-end example is fully synthetic and must not be cited as a real product result.

Use the installation and upgrade commands above, then restart Codex or open a new task to reload the Skill.

Loading