If the goal is to test AI-era engineering, I’d make the exercise a small unfamiliar repo with one seeded bug and one misleading-but-plausible AI suggestion. Let candidates use any tools, then score the trace: what they inspected, what hypothesis they formed, what tests they added, and why they rejected or accepted the generated change. The final diff matters less than whether they can build evidence. That is harder to fake than a polished take-home and closer to real maintenance work.

Android scanners are useful for known signatures, but I wouldn’t treat one as a full replacement for good install hygiene. Because of the app sandbox, a normal scanner can’t deeply inspect everything another app does.

Hypatia can help catch known files, but source, permissions, OS/WebView updates, and checking suspicious APKs before installing still matter more. A clean scan also doesn’t mean an app won’t abuse permissions you voluntarily granted it.