# SimoneAvogadro/android-reverse-engineering-skill

Claude Code skill to support Android app's reverse engineering

Repository: https://github.com/SimoneAvogadro/android-reverse-engineering-skill
Canonical: https://ross.abutalabs.com/products/android-reverse-engineering-skill
Language: Shell
License: Apache-2.0
License Family: permissive
Last push: 2026-06-10T13:03:36+00:00

## Health v2 (maintenance only)
Score: 59/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 86, release rhythm 49, longevity 15
- inputs: {"age_days": 212, "days_push": 84, "days_rel": 128, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7376, forks 825 (observed 2026-08-28T04:09:58.560154+00:00)

## What it is
A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs an app uses, including Retrofit, OkHttp, Ktor, and Apollo endpoints, auth patterns, and hardcoded URLs. It also recovers original Kotlin class names from R8-obfuscated binaries and fingerprints app frameworks before full decompilation.

## Use cases
- extract HTTP API endpoints from an Android APK without source code
- decompile an obfuscated Android app and recover original Kotlin class names
- document the backend APIs used by a mobile app
- reverse engineer Retrofit and OkHttp calls from an APK
- identify whether an Android app is Flutter, React Native, or native before analysis
- find authentication headers and request-signing schemes in an Android app
- trace call flows from activities down to HTTP requests in a decompiled app

## When to choose
- you need to document or reproduce an Android app's HTTP API without its source
- you are analyzing R8/ProGuard-obfuscated Kotlin apps and need original class names
- you want a guided, skill-driven workflow inside Claude Code for APK triage and decompilation
- you need to handle modern Kotlin/KMP stacks like Ktor, Apollo, and Koin, not just Retrofit

## When to avoid
- you need a standalone GUI reverse-engineering tool rather than a Claude Code skill
- you are reverse engineering iOS or non-Android binaries
- you require guaranteed legal clearance - reverse engineering apps may be restricted by terms of service or law
- you need deep dynamic analysis or runtime instrumentation rather than static decompilation

## Facets
- artifact type: plugin
- maturity: active
- function: reverse-engineering, parser, developer-tools, security
- domain: reverse-engineering, android-tools, developer-tools, security, apis
- platform: cli, windows, cross-platform
- tags: claude-code-skill, apk-decompilation, api-extraction, kotlin, r8-deobfuscation, jadx, retrofit, okhttp, ktor, mobile-security, linux, macos

## Member repositories
- SimoneAvogadro/android-reverse-engineering-skill (main) score 59

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:58.560154+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:38:23.073662+00:00, confidence not recorded.
  - readme: https://github.com/SimoneAvogadro/android-reverse-engineering-skill (fetched 2026-08-28T04:09:58.560154+00:00, sha 9b8705983cf0)
- Data as of 2026-08-30T08:39:29.467469+00:00.