Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/credittone/android-reverse-engineering-skill/android-reverse-engineeringnpx skills add CreditTone/android-reverse-engineering-skill --skill android-reverse-engineeringgit clone --depth 1 https://github.com/CreditTone/android-reverse-engineering-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00107 | $0.04118 |
| Opus 5 | $0.00053 | $0.02059 |
| Sonnet 5 | $0.00021 | $0.00824 |
| Haiku 4.5 | $0.00011 | $0.00412 |
Grade B, and why
android-reverse-engineering scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Installs without sudo when possible (downloads to `~/.local/share/`, symlinks in `~/.local/bin/`) How it starts
The opening of the file, as written. The whole thing — 367 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android Reverse Engineering
Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, produce structured documentation of extracted APIs, and escalate to runtime analysis only after static triage shows that it is needed. Two decompiler engines are supported: jadx for broad Android coverage and Fernflower/Vineflower for higher-quality output on complex Java code.
Core Principle
Do not jump straight into Frida, packet capture, or SO analysis. Start with JADX and identify:
- The network stack in use
- The request builder or interceptor chain
- Where signing or encryption appears to happen
- Whether the logic is visible in Java or delegated to native code
Use dynamic analysis only to confirm or bridge gaps that static analysis cannot resolve.
When to Suggest IDA MCP
IDA MCP provides static binary analysis (disassembly, decompilation, cross-references) for .so files. Do NOT suggest it blindly — check these conditions first:
Suggest IDA MCP when the user asks to:
- Find function offsets or exports in a specific SO
- Decompile a known native function to C pseudocode
- Trace cross-references to a string, symbol, or address
- Check whether a SO imports crypto/network libraries
- Analyze a SO that is NOT obfuscated (standard compiler, recognizable function boundaries)
Do NOT suggest IDA MCP when:
- The SO uses control-flow flattening or similary heavy obfuscation — pseudocode will be unreadable. Use Frida scripts instead.
- All strings in the SO are encrypted — static search finds nothing. Use
jni_method_trace.jsto capture runtime decryption. - The user needs runtime values (keys, tokens, parameters, decrypted data) — IDA can only show static code.
- The target SO has not yet been identified — suggest
jni_method_trace.jsfirst to find which SO handles the logic. - The user needs to compute or generate a signature, ciphertext, or token — this requires runtime execution, not static analysis.
What ships with it
24 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/api-extraction-patterns.md 3.6 KB
- references/call-flow-analysis.md 5.2 KB
- references/dynamic-analysis.md 11 KB
- references/fernflower-usage.md 3.7 KB
- references/jadx-usage.md 3.0 KB
- references/native-analysis.md 4.1 KB
- references/setup-guide.md 4.6 KB
- scripts/bypass_frida_svc_detect.js 3.0 KB runs code
- scripts/bypass_root_detect.js 14 KB runs code
- scripts/check-deps.ps1 5.3 KB runs code
- scripts/check-deps.sh 4.2 KB runs code
- scripts/decompile.ps1 14 KB runs code
- scripts/decompile.sh 17 KB runs code
- scripts/dump_dex.js 5.7 KB runs code
- scripts/dump_so.js 1.1 KB runs code
- scripts/find-api-calls.ps1 3.6 KB runs code
- scripts/find-api-calls.sh 3.6 KB runs code
- scripts/hook_artmethod_register.js 3.6 KB runs code
- scripts/hook_encryption_algo.js 21 KB runs code
- scripts/install-dep.ps1 12 KB runs code
- scripts/install-dep.sh 14 KB runs code
- scripts/jni_method_trace.js 11 KB runs code
- scripts/keystore_dump.js 4.4 KB runs code
- scripts/ssl_log.js 768 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 367 lines · 107 tokens per session scan B 14b86e873a24
android-reverse-engineering is a skill published in the GitHub repository CreditTone/android-reverse-engineering-skill (443 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 107 tokens to every session and 4,118 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Mobile Application Security
Android and iOS application security testing — static and dynamic analysis, APK/IPA inspection, OWASP MASVS/MASTG verification, secure-storage and transport review, and mobile malware triage for authorized assessments.
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…
android-reverse-engineering
Decompile Android APK, XAPK, AAB, DEX, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley, GraphQL, WebSocket), trace call flows from UI to network layer, analyze security patterns (cert pinning, exposed secrets, Android Fragment…
android-apk-reverse-engineering
Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.
analyzing-android-dex-malware
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
apk-redteam-pipeline
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external…