App Reverse Engineering

    1

    A structured reverse-engineering methodology and static triage engine for authorized security testing of apps.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    App Reverse Engineering

    Example session with this skill installed

    Run a static triage on my authorized app target.apk and check for any hardcoded secrets.

    • Read your context and instructions
    • Compiled the app reverse engineering

    I have initialized the checklist and performed a static triage on target.apk. The scan identified several sensitive strings and analyzed the manifest for security configurations.

    Triage Results for target.apk

    CategoryFindingEvidenceSeverity
    SecretGoogle API KeyAIzaSyA-1234567890abcdefGHIJKL...High
    SecretFirebase URLhttps://myapp-default-rtdb.fi...Info
    ManifestDebuggable Enabledandroid:debuggable="true"High
    ManifestBackup Allowedandroid:allowBackup="true"Low
    StructureNative Libslibnative-lib.so (found)Info

    Strings Summary

    • Total Strings: 1,452
    • Potential Keys: 2
    • Network Endpoints: 5

    Android Manifest Analysis

    The AndroidManifest.xml indicates the application is running in a debuggable state, which allows for easier debugger attachment. The allowBackup flag is set to true, potentially exposing app data through adb backup.

    Next steps

    1. Decompile DEX: Run jadx -d out target.apk to inspect the code responsible for the identified Google API Key.
    2. Analyze Native Code: Use Ghidra to inspect libnative-lib.so for hardcoded logic or hidden strings.
    3. Update Checklist: Mark static-triage as done and proceed to decompile step.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Reverse-engineer apps the authorised way — Android APK, iOS, Windows and Linux: decompile with apktool and jadx, read smali and native libs, analyse PE and ELF binaries with Ghidra and radare2, run dynamic checks with Frida, and write a findings report worth reading. Includes a static-triage engine (strings, secret patterns, APK/PE/ELF/Mach-O parsing), a findings report template, a 5-step checklist runner and 4 agent command prompts. For authorised testing only — apps you own, have written permission to test, or that are open-source. Experimental / educational — no findings promised; decrypting a store IPA needs a jailbroken device or your own unsigned IPA, and dynamic analysis needs a rooted/jailbroken device or a debuggable build. $5 one-time.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Testing & Debugging.

    Static triage only; no support for DRM/encryption bypass. Obfuscated or packed code requires manual unpacking before analysis. Dynamic analysis requires a rooted/jailbroken device.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 day ago

    Software
    Python

    Permissions

    Terminal / Shell
    Read Files
    Write Files
    Environment Variables
    Listed1 day ago

    What's inside

    Frequently Asked Questions

    This skill supports a wide range of binary formats, including Android (APK), iOS (Mach-O), Windows (PE), and Linux (ELF), making it a versatile solution for cross-platform security audits.

    The skill operates on a 'static-first' methodology, meaning it extracts metadata and secrets without ever executing the file, which minimizes risk during the initial triage phase.

    Yes, the skill is designed to orchestrate industry-standard tools like Ghidra, Frida, and Radare2, providing you with guided workflows tailored to the specific binary you are auditing.

    The skill requires an AI agent capable of executing Python-based environments and managing local file directories to store the triage reports and audit checklists.

    To ensure ethical and legal compliance, the skill includes a mandatory 'Authorization' step that records the legal basis for the test before any analysis commands can be executed.

    While the triage engine is highly effective at scanning readable code, it is currently limited to unpacked binaries and cannot analyze files that are encrypted or heavily obfuscated by DRM.

    New in Testing & Debugging