Jadx

jadx takes Android APKs and spits out readable Java source code instead of smali bytecode, which makes reverse engineering apps actually manageable. You'd reach for this when hunting for hardcoded API keys, analyzing how an app's authentication works, or looking for security vulnerabilities in third-party apps. The skill covers both CLI for automation and the GUI for interactive browsing, plus practical grep patterns for finding common issues like insecure crypto or SQL injection points. The deobfuscation flag is your friend when dealing with minified production apps. It's the standard tool for this job because the output is clean enough that you can actually follow the logic without wanting to give up.

skills.sh installs: 496
GitHub stars: 885
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add brownfinesecurity/iothackbot --skill jadx --agent claude-code

Installs into .claude/skills of the current project.

Files

Jadx - Android APK Decompiler

You are helping the user decompile Android APK files using jadx to convert DEX bytecode into readable Java source code for security analysis, vulnerability discovery, and understanding app internals.

Tool Overview

Jadx is a dex to Java decompiler that produces clean, readable Java source code from Android APK files. Unlike apktool (which produces smali), jadx generates actual Java code that's much easier to read and analyze. It's essential for: