Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/2233admin/reverse-skill-evolver/apk-reversenpx skills add 2233admin/reverse-skill-evolver --skill apk-reversegit clone --depth 1 https://github.com/2233admin/reverse-skill-evolverWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00080 | $0.02909 |
| Opus 5 | $0.00040 | $0.01455 |
| Sonnet 5 | $0.00016 | $0.00582 |
| Haiku 4.5 | $0.00008 | $0.00291 |
Grade A, and why
apk-reverse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
88% identical to apk-reverse — 42 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 378 lines — stays where its author put it; the contents beside it link to each section on GitHub.
APK 逆向 CLI 作业规范
适用范围
当任务属于以下场景时优先使用本 skill：
- 分析 APK 的 Java 业务逻辑
- 定位登录、签名、风控、证书校验、root 检测
- 查看与修改
AndroidManifest.xml - 查看与修改 smali
- 重打包 APK
- 用 Frida 做 Java/native 动态 Hook
- APK 内含
.so时切到 native 分析
当前机器已验证可用的 CLI 工具
jadx1.5.5apktool3.0.2frida-ps17.9.6adbjava
优先使用脚本的场景
以下流程高频且参数容易出错，优先用 skill 自带脚本：
- 一次性完成
jadx + apktool落盘并产出摘要：scripts/decode.ps1 - Frida 设备检查、进程列举、spawn/attach 注入：
scripts/frida-run.ps1 - 重建、对齐、签名、安装 APK：
scripts/rebuild-sign-install.ps1 - 快速抽取 Manifest 关键组件与权限：
scripts/manifest-summary.ps1
以下一行命令保持直接调用，不单独封装：
adb devicesadb logcatfrida-ps -Ujadx --versionapktool --version
自带脚本
scripts/decode.ps1
用途：
- 统一跑
jadx和apktool - 默认在原 APK 同目录创建任务输出目录
- 输出
package、java_files、smali_dirs、so_files等摘要 - 兼容
jadx部分反编译错误但仍然有可用产物的情况
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx
scripts/frida-run.ps1
用途：
- 统一 Frida 的设备、进程、spawn/attach 入口
- 避免手写参数时混淆
-f、-n、-U
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"
scripts/rebuild-sign-install.ps1
用途：
apktool b重建 APKzipalign对齐apksigner签名与验签- 可选直接
adb install
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
- 默认生成并复用调试 keystore
- 默认输出到
ProjectDir同目录，便于和原始包、解包目录放在一起
scripts/manifest-summary.ps1
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- debug.keystore 2.6 KB
- references/android-advanced.md 11 KB
- references/apk-security-checklist.md 6.8 KB
- references/frida-bypass-kit.md 2.4 KB
- references/frida-cookbook.md 14 KB
- scripts/decode.ps1 5.6 KB runs code
- scripts/decode.sh 4.8 KB runs code
- scripts/frida-run.ps1 4.2 KB runs code
- scripts/frida-run.sh 4.0 KB runs code
- scripts/manifest-summary.ps1 2.6 KB runs code
- scripts/rebuild-sign-install.ps1 6.7 KB runs code
- scripts/rebuild-sign-install.sh 6.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 378 lines · 80 tokens per session scan A 06fd45ba992e
apk-reverse is a skill published in the GitHub repository 2233admin/reverse-skill-evolver (13 stars, last pushed 21d ago), licensed MIT. It adds 80 tokens to every session and 2,909 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 88% identical to apk-reverse, differing in 42 lines, and is treated as a copy.
Other skills, from other repositories
orca-emulator-android
Control an Android emulator / device from inside Orca using the orca CLI. Use for listing/booting AVDs, taps, swipes, typing, hardware buttons (incl. Back and Recents), rotation, app install/launch, runtime permissions, the accessibility tree, and logcat — driving a real adb-connected device or emulator.…
speckit-analyze
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation.
add-sample
Create a SamplesApp sample page with correct theming and attributes. Use when adding UI samples for controls.
mapping-to-snomed
Maps clinical concept spans extracted by OpenMed to SNOMED CT concepts through a USER-SUPPLIED terminology server (the user's own Ontoserver, Snowstorm, or UMLS/UTS), never a bundled vocabulary. Use when the user wants to code findings, disorders, procedures, body structures, or substances to SNOMED CT, run an ECL…
android-tombstone-symbolication
Symbolicate the .NET runtime frames in an Android tombstone file. Extracts BuildIds and PC offsets from the native backtrace, downloads debug symbols from the Microsoft symbol server, and runs llvm-symbolizer to produce function names with source file and line numbers. USE FOR triaging a .NET MAUI or Mono Android app…
auditing-subgroup-fairness
Audit an OpenMed NER or de-identification model for performance disparities across demographic subgroups (sex, age band, race/ethnicity when available) using openmed.eval.fairnessreport. Use when the user wants per-subgroup recall and leakage, wants to check whether de-identification under-protects a group, wants to…