Android-RE

Use when the user asks for a MASVS-aligned report, an OWASP MASTG audit, or a formal "is this app secure" assessment. Triggers: "MASVS report", "MASTG audit", "OWASP compliance check", "security audit of <path>". Phase 1 ships a stub; the real implementation lands in Phase 4 with the android-re-triage orchestrator MCP server.

Use when the user wants to assess the native (JNI / C / C++) code inside an APK, audit hardening on .so libraries, or get a report on what a native library does. Triggers: "native triage", "check the .so", "audit libfoo.so", "what does libnative do", "is the native code hardened", "PIE / RELRO / NX on this library", "check for packers / obfuscation in libfoo". Do NOT use for pure DEX analysis (use android-re-static-triage) or for dynamic analysis (use android-re-dynamic-hook).

Use when the user wants to find hard-coded secrets in an APK: API keys, AWS / GCP / Azure credentials, JWTs, private keys, hard- coded URLs, IP addresses, or any other sensitive data embedded in the decompiled source. Triggers: "scan for secrets", "find API keys", "find AWS credentials", "check for hard-coded secrets", "scan the APK for sensitive data", "find URLs in the source". Do NOT use for runtime data leak detection (Phase 3) or for network interception (use android-re-network-intercept).

Use when the user wants to triage an APK, perform a 5-minute static overview, or get a high-level "what does this app do" summary without running it. Triggers: "triage this APK", "what does this app do", "static overview of <path>", "analyze <path>.apk", "give me a quick security summary of this APK". Do NOT use for dynamic analysis, Frida hooking, native binary inspection, or repackaging — those have their own skills.

Use when the user wants the full triage workflow: drop in an APK, run a MASVS-aligned multi-step analysis, and produce a report. This is the master skill that composes every other Android-RE skill and tool. Triggers: "triage this APK end-to-end", "give me a full security report on <path>", "run the orchestrator", "comprehensive triage", "MASVS audit of <app>". Do NOT use this for narrow, single-purpose tasks (use android-re-static-triage, -native-triage, -decompile, -dynamic-hook, etc. directly).

Use when the user wants to read the implementation of a specific method or class, pull Java/smali source for a function, or understand what a particular entry point does. Triggers: "decompile this method", "show me the source of <Class>.<method>", "what does com.example.Foo.bar do", "read <FQCN>", "smali for <method>". Do NOT use for a project-wide overview — use android-re-static-triage for that.

Use when the user wants to hook a method at runtime on a connected Android device, observe arguments/return values, trace execution, or dump runtime state. Triggers: "hook this method", "frida hook on <class>", "trace <method>", "watch this call", "intercept <function>", "runtime trace", "find what calls X". Requires a rooted device with frida-server running. Do NOT use for pure static analysis (use android-re-static-triage) or for native binary-only inspection (use android-re-native-triage).

Use when the user wants to write a custom Frida script (not just a one-off hook) and needs help authoring it. Triggers: "write a Frida script", "I need a custom frida agent", "help me write a hook for <case>", "tracer for <method>", "build a frida gadget". Loads the user-described agent into a session, verifies it compiles, and offers iteration. Requires a rooted device with frida-server running.

Turn an APK into a buildable Gradle project. Composes mcp__android-re-static__open_project, decompile_apk, decode_apk, jadx_cleanup_workdir, and create_gradle_project into a 6-step workflow that produces `./gradlew :app:assembleDebug` output.

Use when the user wants to capture and inspect an app's network traffic end-to-end. Sets up an MITM proxy (Burp, mitmproxy, Charles) on the host, routes device traffic through it, and uses a Frida SSL-pinning bypass to defeat certificate pinning. Triggers: "intercept the traffic from <app>", "set up MITM", "capture HTTPS from <package>", "Burp this app", "see what <app> sends over the network". Requires a rooted device with frida-server, plus a running proxy on the host.

Use when the user wants to modify an APK and produce a new signed build. Common scenarios: add a debuggable flag, set allowBackup=true, change the network security config to trust a user CA, repackage with Frida gadget, or rebuild after a smali-level edit. Triggers: "modify the manifest", "set debuggable to true", "patch the APK", "repackage for testing", "rebuild and sign", "trust user CAs". Do NOT use this for static analysis (use android-re-static-triage) or for dynamic analysis (use android-re-dynamic-hook).

Use when the user wants to bypass SSL/TLS certificate pinning on a running app to intercept HTTPS traffic (e.g. with Burp or mitmproxy). Triggers: "bypass SSL pinning", "unpin cert", "trust user CA", "MITM this app", "intercept HTTPS from <package>", "ssl-pinning bypass on <app>". Requires a rooted device with frida-server running. The app must support installing user CAs (or be repackaged with android-re-repackage first).