mukul975/Anthropic-Cybersecurity-Skills
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Before you install
- Last update
- Files in folder
- 4
- Scripts
- Contains scripts. Review them before running.
- SKILL.md size
- 2.4 KB (about 619 tokens of context each time it loads)
- License
- Apache-2.0
- Source on GitHub
- mukul975/Anthropic-Cybersecurity-Skills
Skills are plain text instructions the agent follows, sometimes with scripts. Check the source, prefer repositories with many installs and stars, and read any script it ships.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-android-malware-with-apktoolRuns in a terminal with Node.js 18 or newer. Add -y to skip the prompts and -g to install for every project instead of this one.
Install for your agent
npx skills add mukul975/Anthropic-Cybersecurity-Skills@analyzing-android-malware-with-apktool --agent claude-code -y- Project install writes to
.claude/skills/analyzing-android-malware-with-apktool- Global install writes to
~/.claude/skills/analyzing-android-malware-with-apktool
Start a new session afterwards so the agent picks the skill up. In Claude Code you can also call it directly with /analyzing-android-malware-with-apktool.
What it does
Analyzing Android Malware with Apktool Overview Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators. When to Use - When investigating security incidents that require analyzing android malware with apktool - When building detection rules or…
Excerpt from the skill's own SKILL.md. Read the full file on GitHub before installing: skills run with your agent's permissions.
Categories
Related skills
- analyzing-api-gateway-access-logs
mukul975/Anthropic-Cybersecurity-Skills
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
- acquiring-disk-image-with-dd-and-dcfldd
mukul975/Anthropic-Cybersecurity-Skills
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
664 installs 35K scripts - analyzing-email-headers-for-phishing-investigation
mukul975/Anthropic-Cybersecurity-Skills
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
604 installs 35K scripts - analyzing-cyber-kill-chain
mukul975/Anthropic-Cybersecurity-Skills
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
600 installs 35K scripts - analyzing-browser-forensics-with-hindsight
mukul975/Anthropic-Cybersecurity-Skills
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved passwords, and extensions from Chrome, Edge, Brave, Opera, and Vivaldi into a unified timeline (XLSX, JSON, or SQLite output). Use during incident response, insider-threat investigations, or criminal cases when you need to reconstruct a user's web activity from a browser profile.
- analyzing-docker-container-forensics
mukul975/Anthropic-Cybersecurity-Skills
Investigate compromised Docker containers by analyzing images, layers,