Use when the user asks for a MASVS-aligned report, an OWASP MASTG
audit, or a formal "is this app secure" assessment. Triggers: "MASVS
report", "MASTG audit", "OWASP compliance check", "security audit of
<path>". Phase 1 ships a stub; the real implementation lands in
Phase 4 with the android-re-triage orchestrator MCP server.
2026-06-05
Use when the user wants to assess the native (JNI / C / C++) code
inside an APK, audit hardening on .so libraries, or get a report
on what a native library does. Triggers: "native triage", "check
the .so", "audit libfoo.so", "what does libnative do", "is the
native code hardened", "PIE / RELRO / NX on this library", "check
for packers / obfuscation in libfoo". Do NOT use for pure DEX
analysis (use android-re-static-triage) or for dynamic analysis
(use android-re-dynamic-hook).
2026-06-05
Use when the user wants to find hard-coded secrets in an APK: API
keys, AWS / GCP / Azure credentials, JWTs, private keys, hard-
coded URLs, IP addresses, or any other sensitive data embedded in
the decompiled source. Triggers: "scan for secrets", "find API
keys", "find AWS credentials", "check for hard-coded secrets",
"scan the APK for sensitive data", "find URLs in the source". Do
NOT use for runtime data leak detection (Phase 3) or for network
interception (use android-re-network-intercept).
2026-06-05
Use when the user wants to triage an APK, perform a 5-minute static
overview, or get a high-level "what does this app do" summary without
running it. Triggers: "triage this APK", "what does this app do",
"static overview of <path>", "analyze <path>.apk", "give me a quick
security summary of this APK". Do NOT use for dynamic analysis, Frida
hooking, native binary inspection, or repackaging — those have their
own skills.
2026-06-05
android-re-triage-orchestrator
Use when the user wants the full triage workflow: drop in an APK,
run a MASVS-aligned multi-step analysis, and produce a report.
This is the master skill that composes every other Android-RE
skill and tool. Triggers: "triage this APK end-to-end", "give me
a full security report on <path>", "run the orchestrator",
"comprehensive triage", "MASVS audit of <app>". Do NOT use this
for narrow, single-purpose tasks (use android-re-static-triage,
-native-triage, -decompile, -dynamic-hook, etc. directly).
2026-06-05
Use when the user wants to read the implementation of a specific
method or class, pull Java/smali source for a function, or understand
what a particular entry point does. Triggers: "decompile this method",
"show me the source of <Class>.<method>", "what does
com.example.Foo.bar do", "read <FQCN>", "smali for <method>". Do NOT
use for a project-wide overview — use android-re-static-triage for
that.
2026-06-05
Use when the user wants to hook a method at runtime on a connected
Android device, observe arguments/return values, trace execution,
or dump runtime state. Triggers: "hook this method", "frida hook
on <class>", "trace <method>", "watch this call", "intercept
<function>", "runtime trace", "find what calls X". Requires a
rooted device with frida-server running. Do NOT use for pure
static analysis (use android-re-static-triage) or for native
binary-only inspection (use android-re-native-triage).
2026-06-05
android-re-frida-script-author
Use when the user wants to write a custom Frida script (not just
a one-off hook) and needs help authoring it. Triggers: "write a
Frida script", "I need a custom frida agent", "help me write a
hook for <case>", "tracer for <method>", "build a frida
gadget". Loads the user-described agent into a session, verifies
it compiles, and offers iteration. Requires a rooted device
with frida-server running.
2026-06-05