What is android-reverse?

A command for examining an Android APK, the installable package used by an Android app. It can unpack the package, turn compiled code into readable Java-like code, inspect resources, and verify its signing certificate.

Use it to decompile or disassemble an APK, inspect its manifest, permissions, resources, and signature, or run a broad analysis.

It collects common inspection steps in one workflow, helping you understand what is inside an Android app and whether its signature is valid.

android-reverse — Command by and3r817

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/and3r817/dot-claude-plugins/android-reverse

Clone the repo

git clone --depth 1 https://github.com/and3r817/dot-claude-plugins

Per session 14 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 2,245 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00014	$0.02245
Opus 5	$0.00007	$0.01123
Sonnet 5	$0.00003	$0.00449
Haiku 4.5	$0.00001	$0.00225

Measured 2d ago against content hash bcfba00157b4, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

android-reverse scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Unrestricted tool accessmediumExcessive agency

A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.

allowed-tools: Bash(jadx:*), Bash(apktool:*), Bash(aapt:*), Bash(apksigner:*), Bash(unzip:*), Read, Grep, Glob, AskUserQuestion

android-analysis/commands/android-reverse.md · 404 lines

How it starts

The opening of the file, as written. The whole thing — 404 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Android Reverse Engineering

Usage

/android-reverse [apk-file] [--decompile|--disassemble|--inspect|--all]

Arguments:

apk-file - Path to APK file. If not provided, searches current directory.
--decompile - Decompile to Java code only (JADX)
--disassemble - Disassemble to smali + resources (apktool)
--inspect - Quick inspection (manifest, signature, resources)
--all - Comprehensive reverse engineering (default)

Implementation

1. Locate APK File

If not provided:

Search current directory for .apk files
Check common build directories: app/build/outputs/apk/
Ask user to provide path

2. Verify Tools Available

Check required tools:

which jadx
which apktool
which aapt
which apksigner

If missing, provide installation instructions based on OS.

3. Quick Inspection (Always Run First)

Signature Verification

apksigner verify --verbose --print-certs <apk-file>

Extract:

Signer certificate info
Signature algorithm
Valid/invalid status

Manifest Analysis

aapt dump badging <apk-file>
aapt dump permissions <apk-file>
aapt dump xmltree <apk-file> AndroidManifest.xml

Extract:

Package name
Version code/name
Min/Target SDK
Permissions
Exported components
Activities, services, receivers

Basic APK Info

aapt dump resources <apk-file>
unzip -l <apk-file> | head -20

Identify:

APK structure
Resource files
Native libraries (.so files)
Asset files

4. Decompilation (if requested or --all)

JADX Decompilation

# Decompile with deobfuscation
jadx --deobf -d output-jadx/ <apk-file>

Options:

--no-res - Skip resources (faster)
--deobf - Attempt deobfuscation
-j 8 - Use 8 threads

Analyze:

Package structure
Class hierarchy
Method implementations
String resources
Obfuscation level

5. Disassembly (if requested or --all)

Apktool Disassembly

apktool d <apk-file> -o output-apktool/

Read the full file on GitHub · 404 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 404 lines · 0 tokens per session scan B bcfba00157b4

Subscribe to this mod's changes

android-reverse is a command published in the GitHub repository and3r817/dot-claude-plugins (2 stars, last pushed 8mo ago), licensed MIT. It adds 14 tokens to every session and 2,245 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (unrestricted tool access). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Languages Mobile claude-code claude-code-hooks claude-code-marketplace claude-code-plugins claude-code-skills

android-reverse