Wireshark is a good tool to see if the application is sending sensitive data in cleartext over the network. Also, you can use ssh and adb to look at the data stored on the SD card and the file permissions, to see if sensitive data is being stored in cleartext.
Some free static analysis tools for Android applications:
Comdroid checks for vulnerabilities related to the use of Intents. See this presentation for description of those vulnerabilities, and other pitfalls.
Stowaway checks for overprivilege: i.e., it checks to see if the application requests permissions that its code doesn't seem to use.
Keep in mind that these are research tools. Moreover, they focus only on a very specific set of vulnerabilities. They are not a general-purpose static analysis tool, and are not substitute for a general-purpose security static analysis tool for Android (like Fortify); they are better thought of as a supplement for other tools available to you.
Some security static analysis vendors have support for analyzing Android applications, e.g., Fortify. Expect these to be expensive.
See also the following questions on this site: