Android APK Malware Static Analysis
Statically triage suspicious Android APKs for permissions, suspicious APIs and network indicators without running them
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, this skill teaches an AI agent how to examine an Android app package (APK) that may be malware without running it. The agent unpacks the app's resources and code, lists the permissions and components it declares, and flags risky combinations such as SMS access plus install rights, obfuscation, dynamic code loading, reflection calls, and hardcoded URLs or IP addresses. It then produces a structured JSON-style risk report mapped to MITRE ATT&CK mobile techniques. It is aimed at security analysts and is also useful for writing mobile malware detection rules.
Great for
- SOC analysts triaging a suspicious APK file from an incident or phishing report
- Security engineers building detection rules for Android malware families
- Students learning static analysis of mobile malware
Skip it if
- Dynamic analysis or confirming runtime behaviour: the skill only inspects code statically, so it cannot prove what a sample does when run
- Analysing live production apps or apps you do not have authority to examine, since this is a reverse-engineering workflow
- Rigorous forensic evidence: the risk score and flags are heuristic and need expert review before any conclusion is drawn
Try asking
- “Triage this suspicious APK for dangerous permissions and list its activities, services and receivers”
- “Check sample.apk for dynamic code loading, Runtime.exec calls and reflection-based API use”
- “Extract hardcoded URLs and IP addresses from this APK to look for possible C2 indicators”
- “Write a JSON risk report for this Android sample mapped to MITRE ATT&CK mobile techniques”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-android-malware-with-apktool.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-android-malware-with-apktool.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-android-malware-with-apktool.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the analysis inside an isolated VM or sandbox, because the agent executes the bundled Python script and external tools against files that may be hostile.
- Treat the heuristic risk score as a starting point and verify key findings such as flagged URLs or APIs manually.
- Ask the agent for a specific output, such as only the permission analysis or only the extracted IOCs, to keep reports focused.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.