القائمة
Run Quark Engine analysis on an APK file — produces summary, detail, JSON, web, call graph, behavior map, and classification reports.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/ev-flow/quark-engine --skill analysisيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Generate a Quark Engine detection rule from a behavior description and decompiled code. Validates the rule against a real APK before outputting it.
Validates dependabot dependency-update PRs against quark-engine's CI and drafts a merge/escalate recommendation. Use when asked to review, validate, or triage a dependabot PR on ev-flow/quark-engine, or when the user references issue 18z/QuarkHQ#3.
Code quality checklist and review automation scripts for quark-engine PRs
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | analysis |
| description | Run Quark Engine analysis on an APK file — produces summary, detail, JSON, web, call graph, behavior map, and classification reports. |
| version | 1.0.0 |
| allowed-tools | Bash |
Use this skill when the user wants to analyze an APK file with Quark Engine. The skill maps the user's analysis request to the correct quark CLI flags, runs the command, and presents the output.
quark --version
If this fails, stop and tell the user: "Quark not found — run pip install quark-engine and try again."
Ask the user for the APK path if not provided. Confirm it exists:
test -f "<apk_path>" && echo "OK" || echo "NOT FOUND"
If not found, stop and ask the user to provide the correct path.
Map the user's request to one of the modes below.
| User intent | Flags to pass to run_analysis.sh |
|---|
| Output |
|---|
| Summary overview | -s | Terminal table of matched rules and confidence |
| Detail per rule | -d | Verbose output for each rule |
| JSON report | -o report.json | JSON file in the current directory |
| Web report | -s -w report.html | HTML file — -s required, silently produces nothing without it |
| Call graph (PNG) | -s -g png | PNG saved in call_graph_image/ — -s required |
| Call graph (JSON) | -s -g json | JSON saved in call_graph_image/ — -s required |
| Behavior map | -l max | Report grouped by behavior label |
| Rules classification | -c | Rules grouped by category |
| Need | Flag | Note |
|---|---|---|
| Use a specific rules directory | -r <rules_dir> | Must be a directory, not a single JSON file |
| Run a single rule file | -s <rule.json> | Replaces the default rules directory |
| Filter by confidence | -t <value> | Allowed values: 20, 40, 60, 80, 100 |
| User intent | Flags | Output |
|---|---|---|
| List all classes and methods | -i all | Every class, method, and descriptor in the APK |
| List Android API calls only | -i native | Only native Android SDK methods |
| List declared permissions | -p | Permissions declared in the manifest |
-C comparison mode — requires user interaction-C opens an interactive terminal dialog that the user must control. Do not try to invoke it automatically. Instead, tell the user:
Label comparison requires interactive input. Run this directly in your terminal:
quark -a "<apk_path>" -C
Skip this step for utility modes (-i, -p).
test -d ~/.quark-engine/quark-rules/rules && echo "OK" || echo "MISSING"
If missing: "Rules directory not found — run freshquark to download the latest rules, then try again."
Before running, print the exact command for the user:
Running: quark -a "<apk_path>" <flags>
Then run it:
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "<apk_path>" <flags>
Examples:
# Summary report
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s
# JSON report to file
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -o report.json
# Call graph PNG (requires -s)
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s -g png
# List native APIs only (no rules needed)
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -i native
# Summary with a custom rules directory
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s -r ~/my-rules/
# Run a single rule file
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s path/to/rule.json
Print the raw quark output verbatim first — do not summarize or paraphrase it. Example of what this looks like for a summary report:
[!] WARNING: Low Risk
[*] Total Score: 1.9
+------------+------------------------------------------------------------+------------+
| Filename | Rule | Confidence |
+------------+------------------------------------------------------------+------------+
| 00002.json | Open the camera and take picture | 100% |
| 00010.json | Read sensitive data(SMS, CALLLOG) and put it into JSON | 100% |
...
+------------+------------------------------------------------------------+------------+
After the raw output, provide analysis and offer next steps:
/quark:rule-gen skill-o report.json for downstream processing-s -g png to visualize which methods triggered a rule