Android Reverse Engineering Skill

Why it's ranked here

The strongest case is its practical triage before expensive decompilation, plus unusually broad coverage of modern Kotlin networking and dependency injection patterns. Side-by-side decompiler output and metadata-based name recovery address common failure modes. However, the Windows implementation is explicitly experimental, and several useful tools remain optional external dependencies.

What's good

The fingerprint pass can prevent wasted work by identifying Flutter, React Native, Cordova, Xamarin, or native Android before decompilation. It scans bytecode strings for networking and dependency injection signals even when names are obfuscated. It also supports comparing two decompilers and preserves partial output when an engine reports errors.

Tradeoffs

Java 17 and jadx are mandatory. Better Java output may require Vineflower or Fernflower, while processing Android packages through those engines also needs dex2jar. Name recovery applies specifically to obfuscated Kotlin metadata and has documented limits. Cross-platform frameworks require separate tools, and PowerShell support is still described as experimental.

How to use it well

Use it for authorized security research, interoperability work, malware analysis, incident response, education, or CTF exercises. Start with fingerprinting, then continue only when the package contains native Java or Kotlin application logic. Treat extracted endpoints as leads for manual tracing and documentation. It does not replace framework-specific tooling for Flutter, React Native, Cordova, Xamarin, or .NET applications.

Observed

License

Apache License 2.0

Packaging

Claude Code marketplace plugin containing one skill and one user-invocable slash command

Interfaces

Claude Code slash command, natural-language skill triggers, standalone Bash scripts, and PowerShell scripts

Input formats

APK, XAPK, JAR, and AAR

Required runtime

Java JDK 17 or newer and jadx CLI

Platform support

Bash tooling plus experimental Windows PowerShell tooling

Decompiler engines

jadx and Fernflower or Vineflower, with optional side-by-side comparison

Repository structure

Plugin manifests, workflow documentation, reference guides, shell scripts, PowerShell scripts, README, and license