How to use the APK Reverse Engineering agent skill

What does the apk-reverse skill make the agent do?

An agent skill is a folder of instructions (a SKILL.md file plus optional references and scripts) that the agent loads when a task matches its description. This skill's description covers APK unpacking, Java decompilation, smali modification, repacking, Frida dynamic hooking, and switching to so/native analysis.

Once loaded, the agent follows a fixed order: triage the APK first (manifest, package, lib/ folder), then read Java logic, then confirm smali and resources, then rebuild or hook, and only then go native. The skill's rules say not to patch smali blindly, not to write a Hook before reading the manifest and main entry point, and not to treat incomplete Java output as proof that logic cannot be analysed.

• Decompiles Java with jadx and unpacks resources and smali with apktool
• Checks AndroidManifest.xml for exported components, permissions and the main launcher activity
• Looks for keywords such as login, sign, encrypt, token, root, certificate and trust in decompiled code
• Hooks Java and native functions with Frida, printing arguments and return values before changing them
• Rebuilds, aligns, signs and installs a modified APK through bundled scripts

Install the apk-reverse skill

You can install the skill in either of two ways. Download the ZIP from the skill page on this site and unzip it. For a personal setup, place the apk-reverse folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder.

If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills. The folder should contain SKILL.md at its top level, alongside the references/ and scripts/ folders.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into the project's .claude/skills/
• Claude apps: upload the ZIP under Settings → Capabilities → Skills

Check the required tools before you start

The skill assumes the command-line tools are already installed and configured. It does not teach installation from scratch. The source lists jadx, apktool, frida and frida-ps, adb, Java, and apksigner and zipalign for signing. Bash is used on Linux or Kali, and PowerShell is used for the Windows script versions. JEB Pro, IDA or radare2 are optional, for deeper native analysis.

Confirm the basics from a terminal with the version and device commands below. The skill's own list records tools verified on one machine, but your versions may differ.

• Java must be installed; apktool depends on a JDK
• zipalign and apksigner come from the Android Build-Tools, which you install manually (for example with sdkmanager "build-tools;35.0.0")
• frida-tools is installed with pip install frida-tools, and Python must already be present

Trigger the skill with natural requests

The agent loads the skill when your request matches its description, so describe the task in plain terms and name the kind of work. Mention the APK, the goal and, where relevant, the device. Be explicit that the app is yours or that you have authorisation to test it.

The skill also responds to requests about native code. If the APK contains .so files, mention the architecture folder you want examined, such as lib/arm64-v8a.

• "Decompile app.apk with jadx and tell me where the login logic is."
• "Unpack my app's APK with apktool and summarise the exported activities in the manifest."
• "I own this app. Hook the certificate check in the OkHttp client with Frida and log the arguments."
• "Rebuild the modified APK in apktool_out, sign it and install it on 127.0.0.1:7555."
• "The login check seems to be in libxxx.so for arm64-v8a. Help me triage the exported JNI functions."

Example workflow: from APK to findings

A typical session starts with decoding. The decode script runs jadx and apktool together and writes a summary of the package, Java files, smali directories and .so files. The output directory is created next to the original APK. Without the script, you can run the two tools by hand using the commands shown here.

After decoding, the agent reads the manifest and the Java entry points, then searches for sensitive areas. Its final report should name the entry components, say whether key logic sits in Java, smali or .so, list the sensitive points confirmed (login, signing, root, SSL, WebView, JNI), and record any patch or hook it made.

Use Frida for dynamic hooks

Static reading is often not enough for login or certificate logic. The skill's Frida guidance is to hook the Java layer first, print parameters and return values, and only then change a return value. Common targets listed in the source include login functions, OkHttp, Retrofit and WebView hook points, javax.crypto and MessageDigest, root-detection functions and SSL pinning logic.

For one-off commands, use the frida tools directly. For repeatable injection, the skill recommends its frida-run script, which avoids mixing up the -f, -n and -U flags.

Rebuild, sign and install a modified APK

When you have edited smali or the manifest, rebuild with apktool. The bundled rebuild-sign-install script wraps the steps: apktool build, zipalign, apksigner signing and verification, and an optional adb install. By default it creates and reuses a debug keystore and writes output next to the project folder.

The skill notes that its apktool path alone does not guarantee a device-ready package, so signing steps may still be needed. Check the script's output and verification result before you rely on the APK.

• -Clean rebuilds from scratch
• -Install with -Reinstall and -DeviceSerial installs to a specific device

Safety notes: scripts and network access

This skill runs scripts and uses the network. Its bootstrap can download jadx and apktool from GitHub releases, install frida-tools from PyPI, and install adb with winget or a fallback path. Read the scripts before running them, and check that your network policy allows these sources. The source also describes automated installation as a convenience, so you can install tools yourself if you prefer.

JEB Pro is commercial software. You must obtain and license it yourself; the package does not download, crack or work around licences. The skill says any third-party JEB MCP bridge must be reviewed for source, permissions, network behaviour and version before you register it.

The skill is oriented toward authorised analysis. Its own rules say to record indicators such as curl-to-shell URLs rather than execute destructive commands. Only run it against apps and devices you are permitted to test.

• Bootstrap downloads from GitHub and PyPI, and may use winget
• Dynamic analysis is meant for devices you are authorised to test
• Do not run unknown install commands from an APK; record them as evidence instead

Tips for better results

Give the agent a precise target. A named class, package, or .so file produces a more focused run than a general request about an app. Tell it what you already know, such as the manifest has been unpacked or the login logic is in a specific class.

Let the agent finish triage before asking for patches or hooks. The skill's order exists because wrong early patches waste time. If Java output is incomplete, ask the agent to check smali and resources rather than declaring the logic unreadable.

• State the package name and the device serial if more than one device is connected
• Ask for the output summary, not just the answer, so you can verify evidence
• Start with read-only hooks that log values before any return-value change