Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/simoneavogadro/android-reverse-engineering-skill/android-reverse-engineeringnpx skills add SimoneAvogadro/android-reverse-engineering-skill --skill android-reverse-engineeringgit clone --depth 1 https://github.com/SimoneAvogadro/android-reverse-engineering-skillWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00117 | $0.03878 |
| Opus 5 | $0.00059 | $0.01939 |
| Sonnet 5 | $0.00023 | $0.00776 |
| Haiku 4.5 | $0.00012 | $0.00388 |
Grade B, and why
android-reverse-engineering scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Installs without sudo when possible (downloads to `~/.local/share/`, symlinks in `~/.local/bin/`) Copies of this mod
1 near-identical copy found in the catalogue:
- android-reverse-engineering — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 313 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android Reverse Engineering
Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported — jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code — and can be used together for comparison.
Prerequisites
This skill requires Java JDK 17+ and jadx to be installed. Fernflower/Vineflower and dex2jar are optional but recommended for better decompilation quality. Run the dependency checker to verify:
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh
On Windows (PowerShell):
& "${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.ps1"
If anything is missing, follow the installation instructions in ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/references/setup-guide.md.
Workflow
Phase 0: Fingerprint the App (recommended before anything else)
Before installing tools or decompiling, run a fast triage to determine what kind of app you are looking at. Decompiling Java is mostly useless for Flutter, React Native, Cordova/Capacitor, and Xamarin apps — the real code lives elsewhere. The fingerprint script tells you which.
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>
It prints, in one screen:
- Mobile framework (Flutter / React Native / Cordova / Xamarin / Native Kotlin / etc.) with the file marker that triggered the verdict.
- HTTP stack (Retrofit, OkHttp, Ktor, Apollo, Volley) detected via DEX string scan — works even when class names are obfuscated.
- DI / serialization signals (Hilt, Dagger, Koin, kotlinx.serialization, Moshi, Gson, Jackson).
- Obfuscation level estimate based on root-level short-named packages.
- Notable third-party SDKs (AppsFlyer, Datadog, Sentry, Firebase, payment SDKs, support/chat SDKs, etc.).
- Consolidated native libraries across the base APK and all splits — XAPK split bundles often place
.sofiles inconfig.<abi>.apk, not inbase.apk. - Recommended next step, which differs by framework (e.g. for Flutter the script suggests
blutter/strings libapp.sorather than jadx).
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/api-extraction-patterns.md 6.9 KB
- references/call-flow-analysis.md 6.8 KB
- references/fernflower-usage.md 3.7 KB
- references/jadx-usage.md 3.0 KB
- references/kotlin-name-recovery.md 4.1 KB
- references/setup-guide.md 4.7 KB
- references/third_party_hosts.txt 2.4 KB
- scripts/check-deps.ps1 5.3 KB runs code
- scripts/check-deps.sh 3.8 KB runs code
- scripts/decompile.ps1 14 KB runs code
- scripts/decompile.sh 17 KB runs code
- scripts/find-api-calls.ps1 3.6 KB runs code
- scripts/find-api-calls.sh 16 KB runs code
- scripts/fingerprint.sh 9.6 KB runs code
- scripts/install-dep.ps1 12 KB runs code
- scripts/install-dep.sh 13 KB runs code
- scripts/lookup-name.sh 2.5 KB runs code
- scripts/recover-kotlin-names.sh 4.9 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 313 lines · 117 tokens per session scan B d06dbd15c4be
android-reverse-engineering is a skill published in the GitHub repository SimoneAvogadro/android-reverse-engineering-skill (7,677 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 117 tokens to every session and 3,878 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orca-emulator-android
Control an Android emulator / device from inside Orca using the orca CLI. Use for listing/booting AVDs, taps, swipes, typing, hardware buttons (incl. Back and Recents), rotation, app install/launch, runtime permissions, the accessibility tree, and logcat — driving a real adb-connected device or emulator.…
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.
winapp-maui
Package and sign .NET MAUI Windows apps with winapp, resolving the resizetizer manifest dependency. Use when packaging or signing a .NET MAUI Windows app, building a MAUI MSIX or signed unpackaged build in CI, or fixing 'manifest contains unresolved placeholders ($placeholder$)' errors from winapp package.
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析.
react-native-ease-refactor
Scan for Animated/Reanimated code and migrate to EaseView.
app_remix
Create a new Rome app from an App Store source, already installed or identified by a pinned Store version. Copy installed code locally or download and extract a Store bundle without installing the source. Never edit or overwrite an existing source app.