The Problem

Android analysts often need to inspect compiled APK/XAPK/JAR/AAR binaries to discover the HTTP APIs an app uses. Without source code, the process requires manual decompilation, dependency management, and pattern‑matching across thousands of generated Java files—an error‑prone, time‑consuming workflow.

What This Does

The repo supplies a Claude Code skill that automates the end‑to‑end pipeline:

  • plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/decompile.sh drives the decompilation step. It detects the file type (APK, XAPK, JAR, AAR), ensures required tools are present, and invokes either jadx (default) or Fernflower/Vineflower.
  • plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/check-deps.sh and install‑dep.sh verify and install external binaries (e.g., jadx, vineflower) on the host OS.
  • plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.sh parses the decompiled source tree, locating Retrofit interfaces, OkHttp calls, hard‑coded URLs, and authentication patterns.
  • Documentation files (SKILL.md, references/*.md) describe the expected output and usage patterns, while plugin.json and marketplace.json expose the skill to Claude Code.

All orchestration is performed via shell scripts; there is no compiled language code or library imports.

How It Is Wired

  1. Entry point – The Claude Code slash command /decompile <path> triggers the skill’s handler (defined in plugin.json). The handler ultimately executes decompile.sh with the supplied path.
  2. Dependency guard – decompile.sh first calls check-deps.sh. If a required tool is missing, it optionally runs install-dep.sh <tool> to install it via the detected package manager (brew, apt, choco, etc.).
  3. Decompilation – Based on the --engine flag, decompile.sh runs: jadx -d <out> <input> for the default engine, or java -jar fernflower.jar <input> <out> / vineflower.jar for the alternative engines. Output is placed under output/sources/.
  4. API extraction – After decompilation, the skill may invoke find-api-calls.sh (either automatically or via a separate slash command). This script walks the source directory, applies a series of grep/awk patterns, and writes findings to a markdown report. The script contains 27 branch points within 91 lines, a medium‑level cognitive‑load issue that makes future modifications risky.
  5. Result delivery – The generated markdown is returned to the Claude session and optionally persisted in the user’s workspace.

No internal module imports exist; the only external interactions are file system reads/writes and calls to Java tools. Consequently, the blast radius of a change is confined to the invoking script and any downstream scripts it calls.

How To Use It

# Clone the repository (use the original URL)
git clone https://github.com/moses-y/android-reverse-engineering-skill.git
cd android-reverse-engineering-skill

# Verify required tools (Java 17+, jadx) – optional, the skill does it automatically
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/check-deps.sh

# Decompile an APK (default engine = jadx)
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/decompile.sh path/to/app.apk

# Extract Retrofit endpoints and hard‑coded URLs
bash plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.sh output/sources/ --retrofit --urls

If the skill is installed in Claude Code, the same actions are available via /decompile <path> or natural‑language prompts such as “Extract API endpoints from this app”.

Real‑World Use

A security consulting team can embed this skill in their analysis pipeline: after receiving a client’s APK, they run the /decompile command, automatically receive a markdown report of all discovered HTTP endpoints, and feed that report into a downstream vulnerability scanner. No manual jadx invocations or grep patterns are required.

Code Health & Issues

  • Medium – High branching density – plugins/android-reverse-engineering/skills/android-reverse-engineering/scripts/find-api-calls.sh has 27 branch points over 91 lines, increasing maintenance cost.
  • Medium – No test suite – The repository contains no test files; code paths are unverified.
  • Medium – No CI/CD – No .github/workflows or other pipeline definitions; automated verification is absent.
  • Repository hygiene – License present, no committed secrets, but missing Dockerfile and lockfiles.

The Bottom Line

The skill delivers a functional, end‑to‑end decompilation and API‑extraction workflow with minimal setup, making it useful for analysts who need quick insight into compiled Android binaries. However, the shell scripts are dense and untested; extending or customizing them will require careful review. Teams that can tolerate a manual‑script codebase and are prepared to add their own tests/CI will get immediate value.