Leaderboard/Security/android-reverse-engineering-skill
Last commit on September 8, 2026·Created on February 2, 2026

SimoneAvogadro/android-reverse-engineering-skill

Maps Android packages from fingerprint to API call flow.
Combined rank
#59
across all skills
In Security
#4
category rank
Stars
7.9k
+0.9% in last 7d
Forks
895
+1.4% in last 7d
Watchers
31
0.0% in last 7d
Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
TL;DR

This skill fingerprints APK and XAPK packages before decompilation, distinguishing native Android code from Flutter, React Native, Cordova, and Xamarin builds. For Java and Kotlin targets, it guides jadx or Fernflower analysis, package and manifest inspection, Kotlin name recovery, endpoint extraction, and call-flow tracing from the UI to Retrofit, OkHttp, Volley, or other network layers.

WHO IT'S FOR
Security researchers
analyze Android apps for vulnerabilities
Malware analysts
reverse engineer malicious Android packages
API integration engineers
extract HTTP API endpoints from apps
Android developers
analyze third-party libraries and AAR files
Repository contents

1 skill file

Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.

Use this skill

Follow the documented setup, then try a first task.

Claude Code from GitHub marketplace

Installs: Installs the complete android-reverse-engineering plugin from the android-reverse-engineering-skill marketplace and makes it available in future sessions. · Claude Code

Before you start
  • Java JDK 17+ installed
  • jadx CLI installed
  1. Inside a Claude Code session, add the repository as a plugin marketplace and install the android-reverse-engineering plugin by entering these commands in order:

    /plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
    /plugin install android-reverse-engineering@android-reverse-engineering-skill

Give it something to do.

Suggested first task

Fingerprint an Android package before decompiling

Uses android-reverse-engineering

  • Path to a local APK or XAPK file
Use the android-reverse-engineering skill to fingerprint `<path-to-app.apk-or-app.xapk>` before decompiling it. Give me a concise report of the detected mobile framework, HTTP stack, dependency-injection or serialization signals, estimated obfuscation level, and notable third-party SDKs. Treat `<path-to-app.apk-or-app.xapk>` as a placeholder for my local APK or XAPK path.