android-re SKILL.md skillA
android-re from cristallin2006/ghidra-skill-for-dsh is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cristallin2006/ghidra-skill-for-dsh/android-re@git:20260925.aecf4b4Pins git:20260925.aecf4b4 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cristallin2006/ghidra-skill-for-dsh
- Path
android-re/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260925.aecf4b4, committed Sep 25, 2026
- First version recorded
- Sep 18, 2026
- Size
- 10,834 bytes
- Repository stars
- 11
- License
- MIT
Android/APK 逆向（纯 DEX / Java 层，APK reversing）：APK 分诊（结构/签名/Manifest/多 dex 自有类统计/flag 全扫）、反编译与校验点定位（jadx/smali）、adb 动态驱动与真机 oracle、v1 未签名 APK 改写重签。触发：APK/Android/DEX/安卓/逆向 APK/smali/jadx。不分析原生 so——APK 内含 lib/ 的 .so 走 ghidra-static；不做流量分析——抓包/隐信道走 traffic-analysis。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Android RE（场景 7：纯 DEX APK 找校验点） 前置：re-triage（路由：APK 含 lib/ → 按 ABI 选 so 走 ghidra-static；纯 DEX → 本 skill）／后继：抠出的 so → ghidra-static；抓到的流量 → traffic-analysis；flag 候选必须过真机 oracle 正负对照后交付 > **纪律**：jadx 已装，**禁止从零自写 DEX/AXML 解析器**；万不得已自写时，结论必须与 apkanalyzer 或 androguard 逐条比对（铁律 11，全文见 ghidra-core §1）——"输出看起来合理"不构成正确性证据。同一路径失败 2 次换工具，单方向 ≤15 分钟（铁律 6，同上）。每个观察/结论走 ghidra-core `scripts/ledger.py` 落账，机制见 ghidra-core `references/evidence-ledger.md`。 ## 路径约定 ```bash # Windows: JADX="$HOME/Desktop/src/tools/jadx/bin/jadx.bat" # jadx 1.5.6（第一反编译源） SDK="$LOCALAPPDATA/Android/Sdk" CT="$SDK/cmdline-tools/latest/bin" # apkanalyzer.bat / sdkmanager.bat / avdmanager.bat ADB="$SDK/platform-tools/adb.exe" EMU="$SDK/emulator/emulator.exe" BT="$SDK/build-tools/37.0.0" # aapt2.exe / apksigner.bat / dexdump.exe AGPY="$HOME/Desktop/src/re-tools-venv/Scripts/python.exe" # androguard 4.1.4（第二独立解析源） KS="$HOME/.android/debug.keystore" # 重签用（androiddebugkey / android，已存在） # WSL/Linux： # JADX="$HOME/tools/jadx/bin/jadx"; ADB="$(command -v adb)"; AGPY="$HOME/re-tools-venv/bin/python" …
Read the whole file at its exact version.
How to install
mdr add cristallin2006/ghidra-skill-for-dsh/android-re@sha256:093a8cbdc84433d8The line at the top of this page pins the label git:20260925.aecf4b4, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_xsenqrtlxcm55rhf)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Sep 18, 2026 and Sep 25, 2026, about one every 2 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260925.aecf4b4 latest | 2026-09-25 | aecf4b4 | 10,834 B | A | view · diff |
| git:20260922.6233b3e | 2026-09-22 | 6233b3e | 9,885 B | A | view · diff |
| git:20260921.58c776a | 2026-09-21 | 58c776a | 9,766 B | A | view · diff |
| git:20260920.b1edfef | 2026-09-20 | b1edfef | 9,534 B | A | view · diff |
| git:20260918.0935154 | 2026-09-18 | 0935154 | 9,502 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10834 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cristallin2006/ghidra-skill-for-dsh · 11 stars · license MIT · pushed 2026-10-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_xsenqrtlxcm55rhf GET https://markdownregistry.com/api/v1/resolve?ref=cristallin2006/ghidra-skill-for-dsh/android-re GET https://markdownregistry.com/api/v1/blob/093a8cbdc84433d89ebf4399a089afc1a91b60e39c14cd25523f7efb1eaa4865
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.