apk-recon

apk-recon is an agent for Claude Code from Paresh-Maheshwari/morphe-ai. It costs 36 tokens per session (852 once invoked), scanned A, original, GPL-3.0.

An Android package reconnaissance tool that records an app's package name, version, SDK levels, format, framework, DEX files, native CPU architectures, and protections. An APK is the package file used to distribute an Android app.

In plain words
What is it for?
Use it as the first inspection step for an Android package, before decompilation or patch-target analysis.
Why use it?
It gives you a structured view of an app before deeper analysis, helping determine what you are working with.

Agent for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: model in frontmatter.

Part of the morphe-patch-creator plugin — 8 skills, 5 agents shipped together

Good fit Use it as the first inspection step for an Android package, before decompilation or patch-target analysis.

Compare 6 agents from other repositories ↓
Install with agentmods
npx agentmods add agents/paresh-maheshwari/morphe-ai/apk-recon
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/Paresh-Maheshwari/morphe-ai

Made for: Claude Code.

Or install morphe-patch-creator, the plugin that ships this one along with the rest of its 8 skills, 5 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for apk-recon

README.md
[![agentmods](https://agentmods.dev/badge/agents/paresh-maheshwari/morphe-ai/apk-recon/github.svg)](https://agentmods.dev/agents/paresh-maheshwari/morphe-ai/apk-recon)
Your own site
<a href="https://agentmods.dev/agents/paresh-maheshwari/morphe-ai/apk-recon"><img src="https://agentmods.dev/badge/agents/paresh-maheshwari/morphe-ai/apk-recon/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for apk-recon

Your own site · 80×15
<a href="https://agentmods.dev/agents/paresh-maheshwari/morphe-ai/apk-recon"><img src="https://agentmods.dev/badge/agents/paresh-maheshwari/morphe-ai/apk-recon.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 36 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 852 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin unknown No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00036 $0.00852
Opus 5.5 $0.00014 $0.00341
Sonnet 5.5 $0.00007 $0.00170
Haiku 4.5 $0.00004 $0.00085

Measured 16d ago against content hash dc240dfcfe47, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

apk-recon scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/morphe-patch-creator/agents/apk-recon.md · 103 lines

The source is not reproduced here

Licensed GPL-3.0

The repository is licensed GPL-3.0, which this catalogue does not treat as permission to reproduce the file. Read it at the source.

Read it on GitHub

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 16d ago First seen · 103 lines · 36 tokens per session scan A dc240dfcfe47

Subscribe to this mod's changes

apk-recon is an agent published in the GitHub repository Paresh-Maheshwari/morphe-ai (180 stars, last pushed 17d ago), licensed GPL-3.0. It adds 36 tokens to every session and 852 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-30.

Related

Other agents, from other repositories

liquid-glass-guide

Apple Liquid Glass design specialist for SwiftUI iOS 26+. Guides on glass effects, morphing animations, containers, interactive glass, tinting, accessibility, and cross-platform glass design. Use when building modern Apple UI with Liquid Glass.

ahmed3elshaer/everything-claude-code-mobile · 54 tokens

network-impl

Network layer implementation specialist. Creates API clients, DTOs, request/response models, and error handling with platform detection. Android: Ktor + kotlinx.serialization. iOS: URLSession + async/await + Codable. KMP: shared Ktor in commonMain.

ahmed3elshaer/everything-claude-code-mobile · 58 tokens

mobile-pr-deprecation-scanner

Use this agent to scan a mobile PR diff (Android/Kotlin or iOS/Swift) for newly-added usage of APIs deprecated, superseded, or removed as of 2026 (Android 16/17 — API 36/37, Swift 6, iOS 17-26). Feed it the diff, changed-file list, and the absolute path(s) to android.md and/or ios.md (whichever platform(s) the diff…

Abdallah-Abdelazim/mobile-pr-review-plugin · 134 tokens

android-coil-compose

Use Coil in Jetpack Compose with AsyncImage, painter variants, sizing, and accessible image loading patterns.

krutikJain/android-agent-skills · 26 tokens

android-compose-accessibility

Make Compose interfaces accessible with semantics, announcements, contrast, focus order, and adaptive touch targets.

krutikJain/android-agent-skills · 24 tokens

android-compose-performance

Profile and improve Compose recomposition, layout, scrolling, startup, and rendering performance in Android apps.

krutikJain/android-agent-skills · 24 tokens