analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-android-malware-with-apktool/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A clean, brief overview with a sensible sequenced workflow, but it under-delivers on actionability and navigation: no code/commands in the body and no references to the bundled agent.py or api-reference.md that contain them. Adding explicit pointers and a validation checkpoint would lift the weakest dimensions.

Suggestions

Add a 'Run the analysis' section in the body that links to scripts/agent.py and shows the CLI invocation (e.g. `python scripts/agent.py sample.apk full`) from references/api-reference.md.

Reference references/api-reference.md explicitly from the Steps or an 'API reference' section so the function and CLI detail is discoverable from the overview.

Insert a validation step in the workflow (e.g. confirm AnalyzeAPK returned a valid APK and sanity-check the risk_score/risk_level before emitting the report).

Dimension	Reasoning	Score
Conciseness	The body is lean and sectioned without padding, though a few 'When to Use' bullets ('When investigating security incidents that require analyzing android malware with apktool') are generic and could be tightened.	4 / 5
Actionability	Steps name tools and specific patterns (e.g. 'DexClassLoader, Runtime.exec') but provide no executable commands or code in the body, and the body never points to the executable agent.py or the CLI reference that hold the real detail.	3 / 5
Workflow Clarity	Seven steps are clearly sequenced, but there are no validation or verification checkpoints (e.g. confirming the APK parsed, sanity-checking the risk score), which the rubric caps at 3 when checkpoints are missing.	3 / 5
Progressive Disclosure	The body is reasonably sectioned and bundle files exist one level deep (references/api-reference.md, scripts/agent.py), but the body never signals or links to them, so the actionable detail is effectively undiscoverable from the overview.	3 / 5
	Total	13 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names tools, concrete actions, and explicit use-when triggers with comprehensive coverage. Only minor weakness is the absence of a few natural synonyms such as the .apk extension.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions tied to named tools — 'resource decompilation', 'Java source recovery', 'manifest inspection', 'dangerous permission-combination detection', 'identification of obfuscated code, dynamic code loading, and reflection-based API calls' — giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (the static analysis actions per tool) and 'when' via the concrete 'Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules' trigger clause.	5 / 5
Trigger Term Quality	Includes natural terms a user would say ('Android APK malware', 'suspicious APK', 'mobile malware detection rules') but misses common synonyms like the '.apk' file extension and 'reverse engineer an app', so it is just short of comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (static triage of Android APK malware) with distinct tooling and triggers, making overlap with other skills minimal.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-android-malware-with-apktool/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.