AwesomeREA.org

Integration

Android Reverse Engineering Skill

Claude Code plugin and agent skill that drives jadx and Fernflower/Vineflower to decompile Android APK, XAPK, JAR and AAR files and document their HTTP APIs. A fingerprint pass first identifies the app's framework, HTTP stack, obfuscation level and native libraries, then shell scripts extract endpoints and authentication patterns across Retrofit, OkHttp, Volley, Ktor and Apollo/GraphQL, trace call flows from UI down to the network layer, and rebuild original Kotlin class names from the metadata R8 leaves behind. It installs through the bundled Claude Code marketplace, and its scripts also run standalone with a /decompile slash command.

Requirements and limitations

  • A Claude Code client with plugin/skill support; install by adding SimoneAvogadro/android-reverse-engineering-skill as a marketplace and installing the android-reverse-engineering plugin, or from a local clone. The reviewed plugin manifest is version 1.5.0 on the master commit, ahead of the latest GitHub release v1.1.0 (2026-04-27).
  • The skill runs external tools it does not bundle: Java JDK 17+ and the jadx CLI are required, and Vineflower or Fernflower plus dex2jar are optional for better Java output; a dependency checker and an OS-detecting install helper are provided. Bash scripts are the primary path, with experimental PowerShell equivalents for Windows.
  • Users supply the Android packages to analyze; the repository ships no app files. Work is static decompilation, API documentation, call-flow tracing and Kotlin name recovery; the author reports roughly complete recovery of the Repository/ViewModel/UseCase classes on a typical app, which is a project-reported figure.
  • Apache-2.0 for the skill; the decompilers and other driven tools keep their own licenses. The README limits use to lawful purposes such as authorized security research, interoperability analysis, and malware analysis, and places responsibility on the user. No decompiler or app was run here, and the reviewed sources establish no REA connection.

About this entry

Type
Integration
Category
Independent agent workflows
Relationship
Independent agent integration
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · SimoneAvogadro/android-reverse-engineering-skill · Revision 0c7cf89
  2. plugins/android-reverse-engineering/skills/android-reverse-engineering/SKILL.md GitHub · SimoneAvogadro/android-reverse-engineering-skill · Revision 0c7cf89
  3. plugins/android-reverse-engineering/.claude-plugin/plugin.json GitHub · SimoneAvogadro/android-reverse-engineering-skill · Revision 0c7cf89
  4. .claude-plugin/marketplace.json GitHub · SimoneAvogadro/android-reverse-engineering-skill · Revision 0c7cf89
  5. LICENSE GitHub · SimoneAvogadro/android-reverse-engineering-skill · Revision 0c7cf89