Android Reverse Engineering & API Extraction skill
A Claude Code skill that decompiles APK, XAPK, JAR and AAR files and finds the HTTP endpoints an app calls
- 8,347 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Runs decompilers and shell scripts and may install dependencies
- Legal risks when analysing apps you do not own
Install
- Works in
Manual install
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skillAfter install the /decompile command is available.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Runs decompilers and shell scripts and may install dependencies
- Legal risks when analysing apps you do not own
This is third-party code. Review the repository files before installing.
What it does
The skill walks the agent through analysing an Android package. It starts with a quick fingerprint: app framework, HTTP stack, obfuscation level and native libraries. Then it decompiles with jadx or Fernflower/Vineflower and searches for Retrofit, OkHttp, Volley, Ktor and Apollo endpoints, auth headers and request signing schemes. For R8 builds a script rebuilds original Kotlin class names from metadata. The result is documentation of the API and call flows from screens down to the network layer.
Who it is for. For security researchers, mobile developers and integrators who need to understand an app's API without its source code.
Good fit when
- Authorised security audit of an Android app
- You need to document the API of your own legacy app without sources
- Malware analysis or CTF practice
Not a fit when
- You have no right to analyse someone else's app
- The app is Flutter or React Native: the skill will point you to other tools
Example request
Decompile app.apk and list every API endpoint with its method and headersLimitations
Requires Java JDK 17+ and jadx, plus dex2jar to use Fernflower on APKs. PowerShell scripts are still experimental. Analysing other people's apps without permission may break laws and terms of service; responsibility lies with the user.
How to disable. Uninstall the android-reverse-engineering plugin via /plugin in Claude Code.
FAQ
What if jadx is missing?
The skill has a dependency check script and an installer script that detects the OS and package manager.
Can I use it without Claude Code?
Yes, the bash scripts in the scripts folder work standalone: fingerprinting, decompiling and API search.
Discussion
No questions or reviews yet.
Related
SkillsA set of reverse engineering skills: symbol and structure recovery, Frida and IDAPython scripting, DEX and IL2CPP dumping, code emulation in Unicorn
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
A JADX plugin and MCP server: the agent explores decompiled Android app code, finds vulnerabilities and helps with reverse engineering
An MCP server on top of apktool: the agent decodes APKs, reads the manifest and smali, searches the code and patches it for Android reverse engineering
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
README in short
The README lists the skill's phases from package fingerprinting to call tracing, environment requirements and two ways to install the plugin. It also covers running the scripts by hand and recovering Kotlin class names after R8. It ends with a lawful use disclaimer: security research, interoperability, malware analysis and education. Apache 2.0 licensed.
README badge
Original SKILL.md
---
name: android-reverse-engineering
description: Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints (Retrofit, OkHttp, Volley), and trace call flows from UI to network layer. Use when the user wants to decompile, analyze, or reverse engineer Android packages, find API endpoints, or follow call flows.
trigger: decompile APK|decompile XAPK|reverse engineer Android|extract API|analyze Android|jadx|fernflower|vineflower|follow call flow|decompile JAR|decompile AAR|Android reverse engineering|find API endpoints
---
# Android Reverse Engineering
Decompile Android APK, XAPK, JAR, and AAR files using jadx and Fernflower/Vineflower, trace call flows through application code and libraries, and produce structured documentation of extracted APIs. Two decompiler engines are supported — jadx for broad Android coverage and Fernflower for higher-quality output on complex Java code — and can be used together for comparison.
## Prerequisites
This skill requires **Java JDK 17+** and **jadx** to be installed. **Fernflower/Vineflower** and **dex2jar** are optional but recommended for better decompilation quality. Run the dependency checker to verify:
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/check-deps.sh
```
## Workflow
### Phase 0: Fingerprint the App (recommended before anything else)
Before installing tools or decompiling, run a fast triage to determine what
kind of app you are looking at. **Decompiling Java is mostly useless for
Flutter, React Native, Cordova/Capacitor, and Xamarin apps** — the real code
lives elsewhere. The fingerprint script tells you which.
```bash
bash ${CLAUDE_PLUGIN_ROOT}/skills/android-reverse-engineering/scripts/fingerprint.sh <file.apk|file.xapk>
```