Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 2233admin/reverse-skill-evolver --skill apk-reversegit clone --depth 1 https://github.com/2233admin/reverse-skill-evolverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/2233admin/reverse-skill-evolver/apk-reverse)<a href="https://agentmods.dev/skills/2233admin/reverse-skill-evolver/apk-reverse"><img src="https://agentmods.dev/badge/skills/2233admin/reverse-skill-evolver/apk-reverse/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/2233admin/reverse-skill-evolver/apk-reverse"><img src="https://agentmods.dev/badge/skills/2233admin/reverse-skill-evolver/apk-reverse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02907 |
| Opus 5.5 | $0.00032 | $0.01163 |
| Sonnet 5.5 | $0.00016 | $0.00581 |
| Haiku 4.5 | $0.00008 | $0.00291 |
Grade A, and why
apk-reverse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to apk-reverse — 44 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 378 lines — stays where its author put it; the contents beside it link to each section on GitHub.
APK 逆向 CLI 作业规范
适用范围
当任务属于以下场景时优先使用本 skill：
- 分析 APK 的 Java 业务逻辑
- 定位登录、签名、风控、证书校验、root 检测
- 查看与修改
AndroidManifest.xml - 查看与修改 smali
- 重打包 APK
- 用 Frida 做 Java/native 动态 Hook
- APK 内含
.so时切到 native 分析
当前机器已验证可用的 CLI 工具
jadx1.5.5apktool3.0.2frida-ps17.9.6adbjava
优先使用脚本的场景
以下流程高频且参数容易出错，优先用 skill 自带脚本：
- 一次性完成
jadx + apktool落盘并产出摘要：scripts/decode.ps1 - Frida 设备检查、进程列举、spawn/attach 注入：
scripts/frida-run.ps1 - 重建、对齐、签名、安装 APK：
scripts/rebuild-sign-install.ps1 - 快速抽取 Manifest 关键组件与权限：
scripts/manifest-summary.ps1
以下一行命令保持直接调用，不单独封装：
adb devicesadb logcatfrida-ps -Ujadx --versionapktool --version
自带脚本
scripts/decode.ps1
用途：
- 统一跑
jadx和apktool - 默认在原 APK 同目录创建任务输出目录
- 输出
package、java_files、smali_dirs、so_files等摘要 - 兼容
jadx部分反编译错误但仍然有可用产物的情况
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx
scripts/frida-run.ps1
用途：
- 统一 Frida 的设备、进程、spawn/attach 入口
- 避免手写参数时混淆
-f、-n、-U
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"
scripts/rebuild-sign-install.ps1
用途：
apktool b重建 APKzipalign对齐apksigner签名与验签- 可选直接
adb install
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
- 默认生成并复用调试 keystore
- 默认输出到
ProjectDir同目录，便于和原始包、解包目录放在一起
scripts/manifest-summary.ps1
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- debug.keystore 2.6 KB
- references/android-advanced.md 11 KB
- references/apk-security-checklist.md 6.8 KB
- references/frida-bypass-kit.md 2.4 KB
- references/frida-cookbook.md 14 KB
- scripts/decode.ps1 4.1 KB runs code
- scripts/decode.sh 4.8 KB runs code
- scripts/frida-run.ps1 1.8 KB runs code
- scripts/frida-run.sh 4.0 KB runs code
- scripts/manifest-summary.ps1 2.6 KB runs code
- scripts/rebuild-sign-install.ps1 4.3 KB runs code
- scripts/rebuild-sign-install.sh 6.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed 5a7250472dd7
- 1mo ago First seen · 378 lines · 80 tokens per session scan A 06fd45ba992e
apk-reverse is a skill published in the GitHub repository 2233admin/reverse-skill-evolver (24 stars, last pushed yesterday), licensed MIT. It adds 80 tokens to every session and 2,907 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 88% identical to apk-reverse, differing in 44 lines, and is treated as a copy.
Other skills, from other repositories
android-reverse-engineering
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to…
android-reverse-engineering
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to…
conducting-mobile-application-penetration-test
Perform a mobile application penetration test on Android and iOS apps to identify insecure data storage, certificate pinning bypass, API vulnerabilities, binary protections, and runtime manipulation using Frida, Objection, and MobSF.
analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…
simvyn
Operate iOS Simulators, Android Emulators, and connected mobile devices with Simvyn. Use for device discovery, app installation and launch, screenshots, logs, deep links, location simulation, app data inspection, device settings, and reusable device workflows through the Simvyn CLI or dashboard.