Loading ToolBench
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
Single tool with minimal schema and weak description. The tool name 'apkpeek_scan' lacks a clear action verb (should be 'scan_apk' or similar). Description is 189 chars but generic, lacks WHEN to use it, prerequisites, or output structure guidance. Input schema has only 'target' param with basic string type; no enum constraints, format hints, or validation rules. No documented output schema despite returning JSON. No error handling guidance. Composition is acceptable (single responsibility) but parameter naming could be more specific (e.g., 'apk_path' vs 'target'). Security: tool accepts file paths, no validation against path traversal shown in code.
One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.. Returns JSON findings.
Tool name lacks action verb. 'apkpeek_scan' is a noun phrase; should be 'scan_apk' or 'scan_android_apk' to signal the action clearly to LLMs.
No input schema validation or constraints. Parameter 'target' is a bare string with no enum, pattern, or format hint. No guidance on accepted file types (.apk, .aab, AndroidManifest.xml) or path validation against traversal attacks.
Output schema not documented. Tool returns JSON findings but LLM has no schema to understand structure (fields, types, nesting). Prevents downstream tool chaining and forces LLM to parse unstructured output.
Description lacks WHEN/WHY context. Generic 189-char description does not explain when to call this vs other security tools, what prerequisites exist (file must be readable, valid APK format), or what the output structure contains.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | 2026-07-28+ | v2 |
No error handling guidance. Code does not show try/catch, validation, or recovery hints. If file is not found, not readable, or malformed, LLM receives no actionable error message.