Maintain the Apk Analyzer Play Store screenshot carousel templates (docs/store/graphics/carouseltemplate.html and carouseltemplatedark.html) and export their frames as upload-ready PNGs (docs/store/graphics/phone-screenshots/day and night). Covers two independent workflows — editing (swap in new screenshots after a UI…
Use when adding a new user-facing string, changing existing English copy, or adding/auditing a locale's strings.xml translations. Triggered by phrases like "translate strings", "add translation", "update translations", "localize this screen", "add a new language", "sync locale strings", "translate to ".
Use to review production Crashlytics crashes and non-fatals for the latest release and file a GitHub issue for each one that isn't tracked yet. Triggered by phrases like "triage crashes", "check production crashes", "look at Crashlytics", "any new crashes", "review non-fatals", "file issues for the latest release…
Android APK unpacking and resource extraction tool for reverse engineering. Use when you need to decode APK files, extract resources, examine AndroidManifest.xml, analyze smali code, or repackage modified APKs.
Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.
Build a minimal Android game APK (like Tetris) from scratch using only Java, Canvas, and android.jar — no Gradle, no Kotlin, no libraries. Result: 16KB APK.
Detect and reverse Java/Android obfuscation with jddlab - ProGuard/R8 renaming, string encryption, control-flow flattening and commercial protectors, using java-deobfuscator, simplify and dex2jar. Use when decompiled code is obfuscated or strings are encrypted.
Analyze an app's native (.so) / JNI code with jddlab - map Java native methods to symbols, extract JNI bindings, and decompile ARM/ARM64 with Ghidra headless. Use when security logic (keys, pinning, root/tamper checks) lives in native libraries.
Bypass Android TLS/certificate pinning with jddlab to intercept HTTPS - android-unpinner, Frida gadget injection (apk-patcher), objection, or manual smali patches. Use when a proxy (Burp/mitmproxy) shows no traffic because of certificate pinning.
Guides the user through capturing an app's network traffic on Android, iOS, desktop, or web, and exporting it as HAR for analysis. Use when a teardown needs network evidence, when the user asks how to see what an app is talking to, or when intake reports network-surface as missing. Triggers on "capture traffic", "how…
Turns a teardown matrix into a reconstructed OpenAPI specification, and optionally generates a CLI from it. Detects specifications that already exist on disk so a spec cast in an earlier session can be pressed into a CLI without redoing any analysis. Triggers on "cast the spec", "generate the OpenAPI", "now build the…
Runs a multi-pass research method that deliberately catches its own blind spots — a shallow first pass, a forced structural self-diagnosis, then corrected and inverted passes. Use when mapping a product's full feature set, tearing down a competitor, doing exhaustive documentation research, or any time a first answer…