Skip to content
Get packs

Guide · Agent skill

How to use the Android Reverse Engineering agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the android-reverse-engineering agent skill, a set of instructions and scripts that lets an AI agent unpack Android app files, search the code for web API endpoints and trace how UI actions reach the network. It is written for people who have never used agent skills before. By the end you will know how to install the skill, how to phrase a request so the agent picks it up, and what the skill needs and where its risks are.

Android Reverse EngineeringSimoneAvogadro/android-reverse-engineering-skill · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
  2. 2Check dependencies. Run check-deps.sh (or check-deps.ps1 on Windows) to confirm Java JDK 17+ and jadx are present.
  3. 3Install anything missing. Install required tools with install-dep.sh, or follow the manual commands the script prints if it needs sudo.
  4. 4Ask for a fingerprint first. Request a fingerprint of the file so the agent can confirm it is a native Java or Kotlin app before decompiling.
  5. 5Decompile the package. Ask the agent to decompile the APK, XAPK, JAR or AAR, choosing jadx, Fernflower or both as needed.
  6. 6Extract endpoints or trace a flow. Ask for the API endpoints or a call flow from a specific screen to the network layer.
  7. 7Review the output. Check the structured notes on APIs and call paths, and confirm you are authorised to analyse the app.

What does the skill make the agent do?

The skill teaches an agent to decompile Android APK, XAPK, JAR and AAR files using jadx or Fernflower/Vineflower, turning compiled packages into readable Java or Kotlin source. It then searches that source for HTTP API endpoints built with Retrofit, OkHttp or Volley, and follows call flows from a UI component down to the network layer.

Before decompiling, the skill runs a fingerprint script that checks whether the app is a native Android app. Flutter, React Native, Cordova, Capacitor and Xamarin apps keep their real code elsewhere, so the skill tells the agent to switch tools for those.

  • Decompile APK, XAPK, JAR and AAR files into source code
  • Identify the mobile framework, HTTP stack and notable SDKs in an app
  • Extract API endpoints and document method, path and parameters
  • Trace the path from a UI click to the network request

Install the skill from the ZIP download

Download the ZIP for this skill from this page. You can install it in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder so it applies only there.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into .claude/skills/ inside the project
  • Claude apps: Settings → Capabilities → Skills, then upload

Install the required tools

The skill needs Java JDK 17 or newer and jadx. Fernflower or Vineflower and dex2jar are optional but improve decompilation quality. The skill includes a dependency checker, check-deps.sh on Bash or check-deps.ps1 on Windows PowerShell, which reports what is missing. If a required tool is absent, the agent can run install-dep.sh (or install-dep.ps1 on Windows) and will show manual instructions if it cannot install automatically. The setup-guide.md reference covers manual installation.

On Windows the PowerShell install script uses winget, scoop or choco, in that order, and then adds its install folder to your user PATH. You may need to re-run the check script in the same terminal to see new tools.

  • Required: Java JDK 17+, jadx
  • Optional: Fernflower or Vineflower jar, dex2jar
bash ~/.claude/skills/android-reverse-engineering/scripts/check-deps.sh

Trigger the skill with natural requests

You do not need to type a command name. Describe what you want in plain language and mention the file or the goal. The skill is triggered by phrases such as decompile APK, decompile XAPK, reverse engineer Android, extract API, analyze Android, follow call flow, find API endpoints and jadx. Chinese trigger phrases such as 反编译APK and 提取API also work.

Good requests name the file and the outcome, for example: decompile this APK and list the API endpoints it calls, or follow the call flow from the login button to the network request.

  • Decompile this APK and tell me what it is built with
  • Extract the HTTP API endpoints from this app's source
  • Follow the call flow from the checkout screen to the network layer
  • Decompile this AAR and use Fernflower for the complex generics

Choose the right decompiler engine

The decompile script accepts three engine options. jadx is the default and is the best first pass on any APK because it is fastest and handles resources. Fernflower suits standalone JAR and AAR libraries and classes with complex lambdas, generics or streams. The both option writes output to separate folders so you can compare them, which helps when jadx produces warnings or broken code.

Useful flags include -o for a custom output folder, --deobf for obfuscated apps, and --no-res to skip resources for a faster code-only pass.

  • jadx: default, first pass on any APK
  • fernflower: JAR and AAR libraries, complex Java code
  • both: compare outputs and pick the best class by class
  • --no-res: quick overview of a large APK
bash ~/.claude/skills/android-reverse-engineering/scripts/decompile.sh --engine both --deobf -o my-app-out my-app.apk

Review the extracted APIs and call flows

The skill tells the agent to search decompiled code with grep for Retrofit annotations such as @GET, @POST, @Query and @Body, plus base URL configuration. For each endpoint the agent should capture the HTTP method, path, path parameters and query parameters. To trace call flows, the agent starts from the manifest at resources/AndroidManifest.xml to find activities, services and receivers, then follows lifecycle methods and click listeners down to the network call.

XAPK files and some APKs are bundle wrappers that hold base.apk and split files. The scripts detect this and decompile base.apk into a base subfolder, with the main source in base/sources/.

  • Retrofit annotations: @GET, @POST, @Query, @Path, @Body, @Headers
  • Entry points: AndroidManifest.xml activities, services, receivers
  • XAPK: the manifest is copied to the output for reference
grep -rn '@GET\|@POST\|@PUT\|@DELETE\|@PATCH' sources/

What people use it for

  • Documenting an undocumented API from an app your team owns so a new client can be built against it
  • Auditing how a mobile app sends data to its backend as part of a security review you are authorised to perform
  • Studying a third-party app's network layer for interoperability or compatibility testing
  • Decompiling a JAR or AAR library to read how a Java implementation works

Frequently asked questions

How do I install the android reverse engineering skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.

What do I need to run it?

The skill requires Java JDK 17 or newer and jadx. Fernflower or Vineflower and dex2jar are optional but recommended for better output. It runs Bash scripts, with PowerShell versions provided for Windows.

Is the android reverse engineering skill free?

The skill is licensed under Apache-2.0. The source does not state pricing for the tools beyond their open licensing, so check each tool's own licence before use.

Which apps does this skill not work well on?

Flutter, React Native, Cordova and Xamarin apps are not suited to Java decompilation. The skill's fingerprint script detects these and recommends different tooling.

Can it decompile XAPK files?

Yes. The decompile script extracts the XAPK archive, finds the base and split APKs, and decompiles each into its own subfolder, copying the XAPK manifest to the output.

What is the difference between jadx and Fernflower here?

jadx is the default first pass on any APK and handles resources. Fernflower is better suited to JAR and AAR libraries and to complex lambdas, generics or streams, and the both option lets you compare them.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you are a security researcher, developer or interoperability engineer who is authorised to analyse a native Android app and wants structured notes on its APIs and call paths. Pick a different approach for Flutter, React Native or Xamarin apps, or if you do not have permission to analyse the app, since the skill's own guidance warns against extracting secrets or API keys.

Download the skill