android-reverse-engineering

Name: android-reverse-engineering
Author: SimoneAvogadro

by SimoneAvogadro·2mo ago

Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extr

Security & ComplianceClaude CodeCodexMedium risk · 中风险open source · 开源

Before you install安装前须知

!Runs shell commands会执行命令

!Accesses the network会访问网络

Editor's verdict· 编辑结论

Auto-published by GitHub discovery based on star threshold.
— Editorial team · 编辑团队

Install via Skills CLI

Use npx skills add to install this skill into the selected agent. Phase 0 commands are generated from source rules, not verified.

Codex

npx skills add https://github.com/SimoneAvogadro/android-reverse-engineering-skill/tree/master/plugins/android-reverse-engineering/skills/android-reverse-engineering -g -a codex -y

Drop `-g` to install project-locally

✓

Best for适合什么场景

High-star GitHub skill discovery candidate.

✗

Not for不适合什么场景

Sensitive or production workflows without local review.

vs alternativesvs 其他选择

Full compare table完整对比表 →

#1api-security-testing

API安全测试的专业技能和方法论

3.7k stars

diff · 差异Best for the OWASP-API-Top-10 workflow — auth bypass, broken object-level authorization, mass assignment, injection paths through API surfaces. Methodology-driven, not just a scanner. Strongest before a major API release or annual security review. Skip it for infrastructure security (TLS, secret rotation); that's a different toolchain.

#2aig-scanner

A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via

3.6k stars

diff · 差异Best for the AI-specific failure modes — prompt-injection vectors, over-broad tool permissions, agent-escape paths, skill supply-chain risk. Catches issues classical app-sec scanners miss because they don't know what an agent or a skill is. Strongest in agent / skill ecosystem audits. Skip it for traditional web-app pentest; api-security-testing is more efficient there.

#3wooyun-legacy

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati

1.6k stars

diff · 差异Best for grounding security review in real-world breach patterns — 22,000+ historical Chinese-internet security cases covering business-logic vulnerabilities, IDOR, race conditions, design-level data leaks. A reference corpus, not a scanner. Strongest as input to a threat-model exercise. Skip it as a standalone scanner; pair with api-security-testing for the actual review.

Side-by-side compare维度对比

Key differences with same-lane alternatives

	this skill · 当前android-reverse-engineering	api-security-testing	aig-scanner	wooyun-legacy
Rating · 评分	—	—	—	—
Stars · 星标	5.6k	3.7k	3.6k	1.6k
Risk · 风险	Medium risk · 中风险	Medium risk · 中风险	Medium risk · 中风险	Low risk · 低风险
Best for · 最适合	High-star GitHub skill discovery candidate.	API安全测试的专业技能和方法论	A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via	WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati
Not for · 不适合	Sensitive or production workflows without local review.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.

Audit notes审计备注

not individually audited · 未独立审计

Source源码open on GitHub · 公开✓

Author作者community · 社区!

Network网络访问not individually audited · 未独立审计!

Filesystem文件写入not individually audited · 未独立审计!

Dependencies依赖not individually audited · 未独立审计!

Telemetry遥测none · 无✓