ranbot-ai/skills/apk-reverse
skills/apk-reverse/SKILL.md
--- name: apk-reverse description: Android APK reverse engineering: unpacking, Java decompilation, smali modification, repacking and signing, Frida dynamic hooking, and native .so analysis with jadx, apktool, adb, and related tools. category: AI & Agents source: antigravity tags: [python, api, mcp, ai, security] url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/apk-reverse --- > **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security
$ install --global
skillsauthnpx skillsauth add ranbot-ai/awesome-skills skills/apk-reverseInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 28, 2026, 3:49 AM147.7s1 file scanned
SKILL.md
- name:
- apk-reverse
- description:
- Android APK reverse engineering: unpacking, Java decompilation, smali modification, repacking and signing, Frida dynamic hooking, and native .so analysis with jadx, apktool, adb, and related tools.
- category:
- AI & Agents
- source:
- antigravity
- tags:
- [python, api, mcp, ai, security]
- url:
- https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/apk-reverse
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
- Ask the user to state the exact target URL, IP, account, or resource.
- Ask the user to confirm written authorization and the permitted scope.
- Show the exact command(s) and explain their expected effect.
- Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
When to Use
- Analyzing or modifying an Android APK during an authorized assessment.
- Hooking runtime behavior of an app you own or are cleared to test.
适用范围
当任务属于以下场景时优先使用本 skill：
- 分析 APK 的 Java 业务逻辑
- 定位登录、签名、风控、证书校验、root 检测
- 查看与修改
AndroidManifest.xml - 查看与修改 smali
- 重打包 APK
- 用 Frida 做 Java/native 动态 Hook
- APK 内含
.so时切到 native 分析
当前机器已验证可用的 CLI 工具
jadx1.5.5apktool3.0.2frida-ps17.9.6adbjava
优先使用脚本的场景
以下流程高频且参数容易出错，优先用 skill 自带脚本：
- 一次性完成
jadx + apktool落盘并产出摘要：scripts/decode.ps1 - Frida 设备检查、进程列举、spawn/attach 注入：
scripts/frida-run.ps1 - 重建、对齐、签名、安装 APK：
scripts/rebuild-sign-install.ps1 - 快速抽取 Manifest 关键组件与权限：
scripts/manifest-summary.ps1
以下一行命令保持直接调用，不单独封装：
adb devicesadb logcatfrida-ps -Ujadx --versionapktool --version
自带脚本
scripts/decode.ps1
用途：
- 统一跑
jadx和apktool - 默认在原 APK 同目录创建任务输出目录
- 输出
package、java_files、smali_dirs、so_files等摘要 - 兼容
jadx部分反编译错误但仍然有可用产物的情况
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\decode.ps1" -ApkPath "D:\DOWNLOAD\app.apk" -Name demo -SkipJadx
scripts/frida-run.ps1
用途：
- 统一 Frida 的设备、进程、spawn/attach 入口
- 避免手写参数时混淆
-f、-n、-U
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -ListDevices
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -ListProcesses
pwsh -File "<skill-root>\apk-reverse\scripts\frida-run.ps1" -Usb -Spawn -Package com.example.app -ScriptPath "D:\hooks\test.js"
scripts/rebuild-sign-install.ps1
用途：
apktool b重建 APKzipalign对齐apksigner签名与验签- 可选直接
adb install
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Clean
pwsh -File "<skill-root>\apk-reverse\scripts\rebuild-sign-install.ps1" -ProjectDir "C:\work\apktool_out" -Install -Reinstall -DeviceSerial "127.0.0.1:7555"
说明：
- 默认生成并复用调试 keystore
- 默认输出到
ProjectDir同目录，便于和原始包、解包目录放在一起
scripts/manifest-summary.ps1
用途：
- 抽取包名
- 列权限
- 列 activity/service/receiver/provider
- 标出主启动 activity
示例：
pwsh -File "<skill-root>\apk-reverse\scripts\manifest-summary.ps1" -ManifestPath "C:\work\apktool_out\AndroidManifest.xml"
如果要分析 .so、lib/arm64-v8a/*.so、lib/armeabi-v7a/*.so，再结合：
ida-reverseradare2
工具分工
jadx
用于：
- Java 反编译阅读
- 包名、类名、方法名搜索
- 先从高层逻辑理解 APK
常用命令：
jadx -d jadx_out app.apk
jadx --single-class com.example.LoginActivity -d jadx_out app.apk
jadx --deobf -d jadx_out app.apk
JEB Pro（可选商业工具）
用于：
- Android DEX / APK / ARM 的交叉验证与深度反编译
- 在 JADX 输出不完整或混淆较重时补充静态分析
- 对同一目标的类、方法与调用关系进行第二工具链校验
边界：
- JEB Pro 是商业软件，必须由用户自行取得并安装有效许可证；本包不会下载、破解或规避许可。
- 仅在
tool-index已确认本机 JEB 可用时调用；否则继续使用jadx、apktool、Ghidra、IDA 或 radare2。 - 第三方 JEB MCP bridge 不是本包依赖。安装前必须按
../ops/skill-supply-chain.md审阅源码、权限、网络行为和版本，再由用户明确确认注册。
apktool
用于：
- 解包 APK
- 查看和修改
AndroidManifest.xml - 查看和修改 smali
- 重建 APK
常用命令：
apktool d app.apk -o apktool_out
apktool b apktool_out -o rebuilt.apk
frida
用于：
- 动态观察 Java 方法调用
- Hook native 导出函数
- 绕过 root 检测、证书校验、调试检测
常用命令：
frida-ps -U
frida -U -f com.example.app -l hook.js
frida-trace -U -f com.example.app -j '*!*certificate*'
adb
用于：
- 设备连接
- 安装 APK
- 查看日志
- 拉取文件
常用命令：
adb devices
adb install -r app.apk
adb shell pm list packages
adb logcat
adb pull /data/local/tmp/file .
推荐工作流
1. Triage
先确定 APK 大致构成，不急着改包或 Hook。
建议动作：
- 用
jadx -d jadx_out app.apk导出 Java 代码 - 用
apktool d app.apk -o apktool_out导出 smali 和资源 - 先看：
AndroidManifest.xml- 主
package application、activity、service、receiverlib/目录里是否有.so
- Issue #65 威胁形态速查（授权样本/设备；详见
../reverse-engineering/references/nonpe-format-cookbook.md§7–8）：- 透明/隐藏图标（AU）：
aapt dump badging+ manifest theme/label/icon →E-android-hidden-icon-manifest - Magisk/脚本格机特征与远程 curl|sh（AR/AS）→ 特征与 URL 入证，不执行破坏命令 <!-- security-allowl
- 透明/隐藏图标（AU）：
Related Skills
ranbot-ai/grok-delegate
tools
VerifiedTrustedCommunity
Delegate coding tasks to the Grok Build CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.
6SKILL.mdUpdated Aug 31, 2026
ranbot-ai/skills/graceful-shutdown
development
VerifiedTrustedCommunity
--- name: graceful-shutdown description: Implement graceful shutdown for servers and workers: drain connections, finish in-flight work, release resources, and exit cleanly on SIGTERM/SIGINT. category: AI & Agents source: antigravity tags: [python, typescript, node, api, claude, ai, template, docker, kubernetes] url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/graceful-shutdown --- # Graceful Shutdown ## Overview A skill for implementing graceful shutdown in server
6SKILL.mdUpdated Aug 31, 2026
ranbot-ai/skills/falsify
development
VerifiedTrustedCommunity
--- name: falsify description: The scientific thinking protocol for AI agents. Use when facing complex, ambiguous, or high-stakes questions where guessing is costly: hypothesis → attempt to break it → evidence → calibrated co category: Creative & Media source: antigravity tags: [markdown, claude, ai, agent, llm, template, design, security, rag, cro] url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/falsify --- # Falsify — The Scientific Thinking Protocol > Think like
6SKILL.mdUpdated Aug 31, 2026
ranbot-ai/delegate-setup
tools
VerifiedTrustedCommunity
Configure approved delegation lanes across installed implementer CLIs, including optional model and effort choices, then write global or project config only after explicit user approval.
6SKILL.mdUpdated Aug 31, 2026