analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.
61
52%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/analyzing-android-malware-with-apktool/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong, specific description that clearly identifies the domain (Android APK malware analysis), names concrete tools and actions, and occupies a very distinct niche. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill over others.
Suggestions
Add a 'Use when...' clause such as 'Use when the user asks to analyze an Android APK, reverse engineer a mobile app, investigate Android malware, or inspect APK permissions and manifests.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: 'decompilation', 'Java source recovery', 'permission analysis', 'manifest inspection', and 'suspicious API call detection', along with specific tools (apktool, jadx, androguard). | 3 / 3 |
Completeness | Clearly answers 'what does this do' with detailed capabilities, but lacks an explicit 'Use when...' clause or equivalent trigger guidance, which caps this dimension at 2 per the rubric guidelines. | 2 / 3 |
Trigger Term Quality | Includes strong natural keywords a user would say: 'Android APK', 'malware', 'static analysis', 'decompilation', 'permission analysis', 'manifest inspection', plus specific tool names (apktool, jadx, androguard) that users familiar with the domain would reference. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive niche combining Android APK malware analysis with specific tools; very unlikely to conflict with other skills given the narrow domain of mobile malware reverse engineering. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
22%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill reads like a high-level outline or table of contents rather than actionable guidance. It completely lacks executable code examples, specific CLI commands, or concrete function calls despite describing a technical analysis workflow involving specific tools (androguard, apktool, jadx). The numbered steps describe what to do conceptually but never show how to do it, making this skill essentially unusable as written.
Suggestions
Add executable Python code examples for each step, e.g., using androguard's APK/AnalyzeAPK classes to parse the manifest, extract permissions, and scan for suspicious API patterns.
Include specific CLI commands for apktool (e.g., `apktool d sample.apk -o output_dir`) and jadx (e.g., `jadx -d output sample.apk`) with expected output descriptions.
Add validation checkpoints, such as verifying the APK parsed successfully, checking that decompilation produced expected directory structure, and validating the output JSON report schema.
Provide a concrete example of the expected JSON output format with sample data showing permission flags, suspicious API calls, and risk scoring criteria.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The content has some unnecessary filler (e.g., 'When to Use' section with generic SOC analyst boilerplate, explaining what static analysis is). However, it's not excessively verbose—it could be tightened but isn't padded with basic concept explanations. | 2 / 3 |
Actionability | The skill provides no executable code, no concrete commands, and no examples. Steps are described abstractly ('Parse APK with androguard', 'Scan for suspicious API calls') without any actual Python code, CLI commands, or specific function calls. This is entirely descriptive rather than instructive. | 1 / 3 |
Workflow Clarity | While steps are numbered, they lack any concrete commands, validation checkpoints, or error handling. There's no feedback loop for verifying results, no indication of what to do if parsing fails, and no validation steps. For a multi-step analysis workflow involving potentially malformed/obfuscated samples, this is insufficient. | 1 / 3 |
Progressive Disclosure | The content has some structural organization with clear sections (Overview, Prerequisites, Steps, Expected Output), but everything is inline with no references to external files for detailed procedures. The content that exists is too shallow to benefit from splitting, but the skill would benefit from linking to detailed guides for each analysis step. | 2 / 3 |
Total | 6 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.