SimoneAvogadro /
android-reverse-engineering-skill
Claude Code skill that decompiles Android apps and lists the HTTP APIs they call
- 8.3k stars
- 314 stars since 3 Oct
- Shell
- Updated 11 days ago
- Some experience
- Agent skills & plugins
Android apps talk to servers through HTTP APIs, but the source code is usually not available. This skill lets Claude Code take a compiled app, decompile it, and write down which endpoints it calls and how it authenticates.
It works in phases. First it fingerprints the file: framework (Flutter, React Native, Cordova, Xamarin or native Kotlin), HTTP stack, obfuscation level and native libraries. Then it decompiles with jadx, Fernflower or Vineflower, and shell scripts search the output for Retrofit, OkHttp, Volley, Ktor and Apollo GraphQL calls. It can also trace the path from an Activity through a ViewModel and repository down to the network request.
Its distinctive feature is Kotlin name recovery. R8 renames classes to things like a.b.c, but it leaves Kotlin metadata strings in place. The skill reads them to rebuild a map from obfuscated names to the original Repository, ViewModel and UseCase names. The README says the Windows PowerShell scripts are experimental.
What it does
Fingerprint first
Before a full decompile, it reports the app framework, HTTP stack, obfuscation level and native libraries, so you know what you are dealing with.
Decompile several formats
Handles APK, XAPK, JAR and AAR files with jadx, Fernflower or Vineflower. You can run one engine or both side by side to compare.
Extract API calls
Finds Retrofit, OkHttp, Volley, Ktor and Apollo (GraphQL) usage, plus hardcoded URLs, auth headers, tokens and HMAC request-signing schemes.
Recover Kotlin class names
Uses Kotlin metadata that R8 cannot strip to rebuild original class names. Separate scripts build the map and look names up in it.
Trace call flows
Follows the code from Activities and Fragments through ViewModels and repositories to the HTTP calls.
What you could build
- Document the backend API of an Android app you are authorized to analyze.
- Triage a suspicious APK by checking its framework, obfuscation and network endpoints.
- Make an R8-obfuscated Kotlin app readable by recovering its original class names.
- Compare jadx and Vineflower output on a hard-to-read library.
- Follow a login flow from the Activity down to the network request.
Get started
Install Java 17+ and jadx, then add the plugin from inside Claude Code with the two commands below. After that, run /decompile on an APK or ask Claude to reverse engineer an app. Only analyze software you have permission to examine.
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill/plugin install android-reverse-engineering@android-reverse-engineering-skill/decompile path/to/app.apkCommands are copied from the project's README. Read it on GitHub for the full setup.
More in Agent skills & plugins
superpowers
A set of skills that makes coding agents plan, test and review before they write code
mattpocock/skills
Small, editable agent skills for planning, testing and reviewing code with AI
ECC
Agents, skills, hooks and memory that add an engineering workflow to coding agents
andrej-karpathy-skills
A CLAUDE.md file that tells Claude Code to ask first, keep code small, edit narrowly
anthropics/skills
Anthropic's example Agent Skills: folders of instructions Claude loads per task
ponytail
A skill that makes AI coding agents write the least code that works
gstack
Slash-command skills that give Claude Code roles like reviewer, QA and release engineer
addyosmani/agent-skills
A pack of 25 Markdown skills that guide AI coding agents from spec to ship
taste-skill
Agent skills that steer AI coding tools toward better layout, type and motion
archify
Agent skill that turns a description or a codebase into an interactive HTML diagram