Skills apktool
📦

apktool

Content revision r2 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables

Analyze Android APKs with Apktool

Android APK internals are difficult to inspect in packaged form. This skill guides decoding, resource review, smali analysis, rebuilding, signing, and troubleshooting with Apktool.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "apktool" from https://skillstore.io/skills/brownfinesecurity-apktool.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-apktool/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brownfinesecurity-apktool.md Signed manifest GET /api/skills/brownfinesecurity-apktool/manifest Signed lockfile GET /api/skills/brownfinesecurity-apktool/lockfile

Test it

Using "apktool". Inspect the decoded manifest for security-relevant configuration.

Expected outcome:

  • Manifest review: package and SDK levels identified.
  • Permissions: sensitive permissions grouped by purpose.
  • Components: exported activities, services, and receivers listed.
  • Configuration: backup, debugging, cleartext traffic, and network security settings summarized.

Using "apktool". Search an IoT companion APK for device communication details.

Expected outcome:

  • Endpoints: candidate service URLs and device addresses listed with source locations.
  • Transport: certificate pinning and trust-management references summarized.
  • Code map: relevant smali classes and native libraries identified.
  • Safety: no endpoint contacted and no credential tested.

Using "apktool". Rebuild and verify an authorized modified APK.

Expected outcome:

The APK was rebuilt, aligned, signed with a test key, and verified. The report lists artifact paths and any build warnings.

Security Audit

High Risk
v9 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown formatting, literal searches, and legitimate local signing examples. Unquoted shell placeholders create an injection risk, and the credential-testing workflow requires stronger authorization controls despite the ethics notice.

1
Files scanned
490
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:34SKILL.md:218SKILL.md:393SKILL.md:470
Unquoted shell placeholders permit command injection
Commands place file, directory, tag, and framework placeholders directly into shell examples without quoting. Raw substitution could execute shell metacharacters or inject options.
The placeholders are visibly unquoted in multiple shell commands. Exploitation depends on an agent substituting untrusted text verbatim, so confidence is high but not absolute.
Medium
SKILL.md:327-330
Credential testing against external devices
The integration workflow tells users to test credentials found in APK resources against IoT devices. This can enable unauthorized access when ownership or scope is unverified.
The credential-testing instruction is explicit. The later authorization and responsible-disclosure rules reduce misuse risk but do not enforce scope before testing.

Risk Factors

⚙️ External commands (50)
SKILL.md:33-35 SKILL.md:35-38 SKILL.md:38-40 SKILL.md:40-43 SKILL.md:43-45 SKILL.md:45-51 SKILL.md:51-70 SKILL.md:70-75 SKILL.md:75-79 SKILL.md:79-85 SKILL.md:85-89 SKILL.md:89-100 SKILL.md:100-103 SKILL.md:103-109 SKILL.md:109-110 SKILL.md:110-115 SKILL.md:115-127 SKILL.md:127-131 SKILL.md:131-142 SKILL.md:142-148 SKILL.md:148-163 SKILL.md:163-169 SKILL.md:169-181 SKILL.md:181-187 SKILL.md:187-189 SKILL.md:189-192 SKILL.md:192-204 SKILL.md:204-210 SKILL.md:210-219 SKILL.md:219-225 SKILL.md:225-243 SKILL.md:243-249 SKILL.md:249-266 SKILL.md:266-270 SKILL.md:270-282 SKILL.md:282-286 SKILL.md:286-293 SKILL.md:293-300 SKILL.md:300-316 SKILL.md:316-341 SKILL.md:341-344 SKILL.md:344-350 SKILL.md:350-351 SKILL.md:351-356 SKILL.md:356-370 SKILL.md:370-392 SKILL.md:392-394 SKILL.md:394-398 SKILL.md:398-399 SKILL.md:399-401
📁 Filesystem access (1)
SKILL.md:242
🔑 Env variables (1)
SKILL.md:233
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/brownfinesecurity-apktool/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-apktool/security.svg)](https://skillstore.io/skills/brownfinesecurity-apktool?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brownfinesecurity-apktool?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-apktool/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-apktool.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

BrownFineSecurity. (2026). apktool security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-apktool/audits/9

BibTeX citation

@techreport{brownfinesecurity-brownfinesecurity-apktool-2026, author = {BrownFineSecurity}, title = {apktool security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/brownfinesecurity-apktool/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "apktool security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "BrownFineSecurity" date-released: "2026-07-23" url: "https://skillstore.io/skills/brownfinesecurity-apktool/audits/9" identifiers: - type: other value: "skillstore:brownfinesecurity-apktool:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance

What You Can Build

Review a mobile application

Decode an authorized APK and inspect its manifest, resources, and smali for security weaknesses.

Diagnose an Android build

Inspect packaged resources, rebuild approved changes, sign the test APK, and troubleshoot failures.

Map IoT companion behavior

Locate device endpoints, certificate pinning, native libraries, and communication classes without contacting devices.

Try These Prompts

Decode an APK 
Decode [APK path] into [output directory], preserve the original, and summarize the generated directory structure.
Review manifest and resources 
Analyze [decoded directory]. Report permissions, exported components, backup and debug settings, network configuration, URLs, and suspected hardcoded secrets.
Trace IoT communication 
Inspect [decoded directory] for IoT endpoints, certificate pinning, native libraries, and related smali classes. Do not contact any endpoint.
Rebuild an authorized test APK 
Rebuild [decoded directory] as [output APK], validate changed smali and XML, sign with a test key, verify, and report each artifact.

Best Practices

  • Analyze only APKs you own or have permission to test, and preserve an untouched copy.
  • Quote and validate every path before running commands, especially when force overwrite is enabled.
  • Use protected test keys, verify signatures, and keep debug-signed APKs out of production.

Avoid

  • Do not substitute untrusted text directly into shell commands or use force overwrite without checking the destination.
  • Do not contact endpoints or test extracted credentials without confirmed authorization and scope.
  • Do not distribute modified APKs or sign production releases with debug keys.

Frequently Asked Questions

Does this skill install Apktool or Java?
No. Install Apktool, a compatible Java runtime, and any referenced utilities before using the workflows.
Can it produce readable Java source?
Apktool produces smali bytecode. Use Jadx alongside it when readable Java output is needed.
Can it rebuild modified APKs?
Yes. It guides rebuilding, alignment, signing, and verification for APKs you are authorized to modify.
Does APK analysis require network access?
No network access is required for decoding. Endpoint or credential testing requires separate tools, explicit authorization, and user approval.
How are possible secrets handled?
Searches run against local decoded files. Protect reports and extracted resources because they may contain sensitive application data.
Will it work with obfuscated or system APKs?
It can decode them, but names may remain unreadable. System APKs may also require matching vendor framework resources.

Developer Details

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/apktool

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

12 downloads · 257 views

File structure

📄 SKILL.md