Is the Apktool skill free?

Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Apktool SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.

How do I install Apktool?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Apktool with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Apktool

Decode, analyze, and repackage Android APKs with apktool for security review

by BrownFineSecurity · BrownFineSecurity/iothackbot

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.8/10
Tested: Jul 21, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 5858535

Fetched SKILL.md via the GitHub tree at skills/apktool/SKILL.md; frontmatter parses with name+description and the dir contains only SKILL.md (no bundled scripts to break). Installed apktool 3.0.3 via brew and decoded a real 38KB open-source APK (org.fdroid.fdroid.privileged). Baseline (my own unpack + manifest glance) surfaced only two uses-permission lines; following the skill's Workflow-1 report block verbatim additionally surfaced the exported org.fdroid.fdroid.privileged.PrivilegedService (exported="true", privileged process), allowBackup="false", debuggable check, and package/version — a concrete disciplined-checklist uplift over baseline. No security smells (its password/secret greps are legitimate analysis, no curl|sh or exfiltration).

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 7/10
Docs & honesty 5/5

What Apktool does

Guides Claude through reverse engineering Android APK files with the apktool CLI: decoding resources and AndroidManifest.xml, disassembling DEX to smali, running systematic grep-based security checks (permissions, exported components, hardcoded secrets, debuggable flag), and repackaging modified APKs. Triggers when a user asks to unpack, decode, or analyze an APK, examine a manifest, inspect smali code, or rebuild an APK. Requires the external apktool CLI and a JRE.

How to install Apktool

git clone --depth 1 https://github.com/BrownFineSecurity/iothackbot.git /tmp/apktool-src
mkdir -p ~/.claude/skills
cp -R /tmp/apktool-src/skills/apktool ~/.claude/skills/apktool
# Requires the external apktool CLI + a JRE (skill shells out to `apktool`, does not bundle it):
#   macOS:  brew install apktool   (pulls Java automatically)
#   Debian: apt install apktool
# No bundled scripts — SKILL.md is the only file in the skill dir.
# Plugin marketplace alternative: repo ships .claude-plugin/marketplace.json (installs all iothackbot skills).

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Apktool

/apktool Decode, analyze, and repackage Android APKs with apktool for security review

It also activates on plain-language prompts like these:

Decode this APK and extract its resources
Examine the AndroidManifest.xml in this APK
Repackage this modified APK after editing smali code

Frequently asked questions

Is the Apktool skill free?: Yes. The skill itself is free from BrownFineSecurity/iothackbot. SkillProof publishes the install command and an independent test verdict at no cost.
Does Apktool work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Fetched SKILL.md via the GitHub tree at skills/apktool/SKILL.md; frontmatter parses with name+description and the dir contains only SKILL.md (no bundled scripts to break). Installed apktool 3.0.3 via brew and decoded a real 38KB open-source APK (org.fdroid.fdroid.privileged). Baseline (my own unpack + manifest glance) surfaced only two uses-permission lines; following the skill's Workflow-1 report block verbatim additionally surfaced the exported org.fdroid.fdroid.privileged.PrivilegedService (exported="true", privileged process), allowBackup="false", debuggable check, and package/version — a concrete disciplined-checklist uplift over baseline. No security smells (its password/secret greps are legitimate analysis, no curl|sh or exfiltration).
What is the Apktool SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 5/5.
How do I install Apktool?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Apktool with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.