How to use the binary-mobile-reversing agent skill

What the skill makes the agent do

A skill is a folder with a SKILL.md file that tells the agent when and how to apply a specific method. This one gives the agent a detailed reverse engineering playbook for compiled software. The playbook covers reading Android app manifests, decoding obfuscated strings and configuration, bypassing certificate pinning so HTTPS traffic can be inspected, finding exposed components and insecure storage, and working through memory-corruption exploit steps.

The skill is a text guide, not a finished product. It names tools and points to scripts, and the results depend on the target you give it.

• Android APKs: decompile, read the manifest for exported components, deeplinks and debuggable flags, and search for hardcoded keys and API addresses
• UniApp and Flutter apps: locate the business logic in JavaScript or in libapp.so, and extract URLs, API paths and credentials
• Native .so libraries and Windows EXE files: extract strings, decompile with Ghidra or IDA, and debug with x64dbg
• IoT firmware: extract with binwalk and debug binaries with qemu-user
• Memory-corruption work: check protections with checksec, then follow the steps from primitive to control-flow hijack

How to install the binary-mobile-reversing skill

Download the ZIP file for the skill from this page. Unzip it into one of two places. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ in your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

How to trigger the skill with natural requests

You do not need a special command. The skill's description says it applies when reversing APK or EXE files, UniApp, Flutter, native .so libraries or memory-corruption exploits, so ask for that work in plain words and name the file you have. Include the authorisation context, because the skill is written for authorised assessments.

Good requests name the target type and the goal, for example what you want to find or bypass.

• Reverse this APK and list the exported activities and any deeplinks in the manifest
• This is an authorised test. Help me bypass certificate pinning in this Android app so I can see its HTTPS API calls
• Find hardcoded URLs and keys in libapp.so from this Flutter build
• Analyse this firmware image and extract the filesystem
• Check the protections on this binary with checksec and suggest where a stack overflow could be

Example workflows the playbook describes

For a standard Android app, the playbook starts with static work: decompile the APK, read the manifest, then search the code for hardcoded secrets and API addresses. Dynamic work with frida and objection comes after that.

For a UniApp APK, most business logic sits in JavaScript rather than in the DEX code, so the playbook focuses on the app-service JavaScript file and on decoding its obfuscation. For a Flutter APK, it describes a fast path: extract strings from libapp.so without unpacking the app first.

What you need before you start

The skill names a set of tools. You install these yourself; the skill does not supply them. The Android tools include apktool, jadx, frida and objection. The binary tools include strings, Ghidra, IDA, x64dbg, checksec, ROPgadget and pwntools. JavaScript decoding uses Node.js.

Some tasks need extra setup. Runtime traffic capture uses an Android emulator (Waydroid or an AVD) with tcpdump or mitmproxy. Firmware work uses binwalk and qemu-user.

• Android: apktool, jadx, frida, objection
• Binary: strings, Ghidra or IDA, x64dbg, checksec, ROPgadget, pwntools
• Scripts: Node.js for the bundled JavaScript decoder
• Optional runtime capture: Waydroid or AVD emulator with tcpdump or mitmproxy
• Optional firmware: binwalk, qemu-user

Safety notes on scripts and network use

This skill runs scripts and uses the network. Its playbook refers to bundled scripts such as a JavaScript RC4 deobfuscator and a Chengzi decryption script, so read any script before you run it and check what it does. Several techniques it describes send traffic to real servers or contact third-party cloud endpoints, so run the work only against targets you own or are permitted to test.

The skill is written for authorised work. It says cracking, tampering with or redistributing apps you do not own or have permission to test may be illegal and may break terms of service. Do not use it that way. Because the guidance includes exploitation techniques and is dense, have an expert review any output before it supports a production security sign-off.

• Run bundled scripts only after reading them
• Keep traffic capture and network checks inside your authorised scope
• Treat exploitation steps as material for expert review, not as finished results

Tips for better results

Give the agent the exact file and its type, and say what you already know, such as the package name or the framework. The playbook has separate paths for UniApp, Flutter, general Android apps, native libraries, EXE files and firmware, so an accurate identification saves time.

Expect some findings to need follow-up. The playbook notes that some items look alarming but are not what they seem, for example IP lists in a native library that are DNS nodes rather than API servers, and resource errors that are deliberate protections. Ask the agent to explain its reasoning before you act on a finding.

• Name the framework first if you know it (UniApp, Flutter, native, EXE, firmware)
• Ask for the protection check (checksec) before exploit work
• Ask the agent to verify a suspected endpoint before reporting it