android-reverse-engineering-skill

Why we included this project

When you need to work with an Android app and the source code is not available, this skill takes over the slow, manual parts of reverse engineering. It fingerprints an APK or XAPK first to identify the framework, HTTP stack, and obfuscation level before you commit to a full decompile, then uses jadx to decompile APK/XAPK/JAR/AAR files and extracts the HTTP surface: Retrofit and OkHttp endpoints, hardcoded URLs, auth headers, and request-signing schemes. Its most useful trick is with modern Kotlin and KMP apps that ship R8-obfuscated, where it recovers original class names from metadata R8 cannot strip and reads Ktor, Apollo GraphQL, and Koin stacks, not just the classic Retrofit/OkHttp pair. Because it runs inside the Claude Code harness, you can work conversationally, asking it to trace a call flow from a specific activity or pull out a targeted endpoint without hand-driving command-line decompilers. For a security audit or reproducing a mobile API, that turns a multi-tool chore into a guided process.