From 9ac132bfd9f3b681785fa5f49d970dbc90ef88c0 Mon Sep 17 00:00:00 2001
From: Simone Avogadro <simone@avogadro.me>
Date: Sun, 11 Oct 2026 19:14:44 +0200
Subject: [PATCH] chore: address marketplace policy holds

- /decompile: pre-approve only check-deps.sh and decompile.sh instead of a
  scripts/* wildcard; install-dep.sh now asks the user each time
- find-api-calls.ps1: rename -Auth switch to -AuthPatterns (matches the .sh
  rename; -Auth still works via PowerShell parameter-prefix matching)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DcUE1A6iyBfWDmpdR5JzNF
---
 .../android-reverse-engineering/commands/decompile.md  |  2 +-
 .../skills/android-reverse-engineering/SKILL.md        |  2 +-
 .../scripts/find-api-calls.ps1                         | 10 +++++-----
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/plugins/android-reverse-engineering/commands/decompile.md b/plugins/android-reverse-engineering/commands/decompile.md
index e04f0e5..5fddf5a 100644
--- a/plugins/android-reverse-engineering/commands/decompile.md
+++ b/plugins/android-reverse-engineering/commands/decompile.md
@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/*), Read, Glob, Grep
+allowed-tools: Bash(bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh), Bash(bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/decompile.sh *), Read, Glob, Grep
 description: Decompile an Android APK/XAPK/JAR/AAR and analyze its structure
 user-invocable: true
 argument-hint: <path to APK, XAPK, JAR, or AAR file>
diff --git a/plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md b/plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md
index 7659215..a76f2b1 100644
--- a/plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md
+++ b/plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md
@@ -246,7 +246,7 @@ On Windows (PowerShell):
 & "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/find-api-calls.ps1" <output>/sources/ -Urls
 
 # Only auth patterns
-& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/find-api-calls.ps1" <output>/sources/ -Auth
+& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/find-api-calls.ps1" <output>/sources/ -AuthPatterns
 ```
 
 Document the endpoints in **two tiers** — going deep on every endpoint is
diff --git a/plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.ps1 b/plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.ps1
index 8c012fc..1f56583 100644
--- a/plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.ps1
+++ b/plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.ps1
@@ -2,7 +2,7 @@
 # NOTE FOR REVIEWERS: this script only greps the *decompiled sources passed as <source-dir>*
 # for strings such as "api_key", "bearer" or "authorization" and for http(s):// URLs.
 # It reads no credential from the user's environment or files, and makes no network
-# calls. The --auth option (-Auth) is just a search-section selector.
+# calls. The -AuthPatterns switch is just a search-section selector.
 param(
     [Parameter(Position=0)]
     [string]$SourceDir,
@@ -10,7 +10,7 @@ param(
     [switch]$OkHttp,
     [switch]$Volley,
     [switch]$Urls,
-    [switch]$Auth,
+    [switch]$AuthPatterns,
     [switch]$All,
     [Alias('h')]
     [switch]$Help
@@ -32,7 +32,7 @@ Options:
   -OkHttp         Search only for OkHttp patterns
   -Volley         Search only for Volley patterns
   -Urls           Search only for hardcoded URLs
-  -Auth           Search only for auth-related patterns
+  -AuthPatterns   Search only for auth-related patterns
   -All            Search all patterns (default)
   -Help           Show this help message
 
@@ -55,7 +55,7 @@ if (-not (Test-Path $SourceDir)) {
 }
 
 # Default to all if no specific flag set
-$searchAll = (-not $Retrofit -and -not $OkHttp -and -not $Volley -and -not $Urls -and -not $Auth) -or $All
+$searchAll = (-not $Retrofit -and -not $OkHttp -and -not $Volley -and -not $Urls -and -not $AuthPatterns) -or $All
 
 function Write-Section {
     param([string]$Title)
@@ -113,7 +113,7 @@ if ($searchAll -or $Urls) {
 }
 
 # --- Auth patterns ---
-if ($searchAll -or $Auth) {
+if ($searchAll -or $AuthPatterns) {
     Write-Section "Authentication & API Keys"
     Search-Sources '(?i)(api[_\-]?key|auth[_\-]?token|bearer|authorization|x-api-key|client[_\-]?secret|access[_\-]?token)'