Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This skill helps security researchers and malware analysts reverse engineer Android applications. It provides a structured workflow to decompile APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower, allowing users to trace execution from the UI layer down to the network layer.
By fingerprinting apps for mobile frameworks and HTTP stacks, it identifies whether an application uses Retrofit, OkHttp, or Volley to facilitate the extraction of HTTP API endpoints and the analysis of third-party libraries.
WHO IT'S FOR
Security researchers
analyze Android apps for vulnerabilities
Malware analysts
reverse engineer Android packages to identify threats
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
Claude Code from GitHub marketplace
Installs: Installs the complete android-reverse-engineering plugin from the android-reverse-engineering-skill marketplace and makes it available in future sessions. · Claude Code
Before you start
Java JDK 17+ installed
jadx CLI installed
Inside a Claude Code session, add the repository as a plugin marketplace and install the android-reverse-engineering plugin by entering these commands in order:
Installs: Clones the repository locally, then installs its complete android-reverse-engineering plugin through a local Claude Code marketplace. · Claude Code
Inside a Claude Code session, replace `/path/to/android-reverse-engineering-skill` with the path to the cloned repository, then enter these commands in order:
Use the android-reverse-engineering skill to fingerprint `<path-to-app.apk-or-app.xapk>` before decompiling it. Give me a concise report of the detected mobile framework, HTTP stack, dependency-injection or serialization signals, estimated obfuscation level, and notable third-party SDKs. Treat `<path-to-app.apk-or-app.xapk>` as a placeholder for my local APK or XAPK path.
Claude