Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

Extract a safe ZIP-formatted APK fixture and analyze the API secret recorded in its Android resources. No real device or app is used.
evidence/app.apk can be extracted with unzip
Inspect res/values/strings.xml
Decode the api_secret_b64 value with base64 -d