Four open-source skills that decompile Android packages, iOS binaries and obfuscated JavaScript bundles. Star counts and licenses below were read from the GitHub API on 13 August 2026, not lifted from someone else's article.
The clips going around describe the biggest of them as a tool that reverse engineers anything. Its own description says something narrower, and the difference is the whole point of this page.
Reverse Engineering / Authorized Penetration Testing / Security Research Skill Router Pack
the repository's own description, first line
Every repo here is public, free and legal to download. What decides whether running one is ordinary work or a serious problem is not the tool. It is what you point it at.
If the target is not on this list, stop. This is a practical scope checklist, not legal advice.
Your app, your build, your account. The uncomplicated case, and the one most people actually need.
In writing, naming the systems, before you start. A verbal yes from someone who does not own the system is not scope.
The program's own scope page lists it. Out-of-scope assets are out of scope even when the same company owns them.
Whatever authorised the work should still be findable months later. Authorisation you cannot produce is authorisation you did not have.
Its own description calls it a skill router pack for reverse engineering, authorized penetration testing and security research. You hand it a target; it picks the toolchain, bootstraps whatever is missing, and reads the output back. That routing layer is why it keeps working on obfuscated builds where a single tool stalls.
Narrower than the router and easier to read end to end because of it. A good first stop if you only care about APKs and want to understand what each step is doing rather than delegate the choice.
Decompiles APK, XAPK, AAB, DEX, JAR and AAR, then extracts the HTTP endpoints and traces call flows. Useful when the question is specifically what does this app talk to, rather than how does it work.
Drives radare2, rizin or headless Ghidra to decompile functions and trace cross-references, with detection for the usual protections. The smallest project here, and the only one covering iOS.
Counts read from the GitHub API on 13 August 2026. They drift; the licenses do not.
It depends on what you reverse engineer, why, and where you are — which is why the checklist above is about the target rather than the tool. In the US, DMCA section 1201(f) carves out circumvention for interoperability, and only for interoperability, by someone who lawfully obtained the copy. In the EU, article 6 of the Software Directive is similarly narrow, and the Court of Justice has separately held that a lawful licensee may decompile to correct errors. None of that is a general permission, and none of this page is legal advice. If the answer matters commercially, ask a lawyer in your jurisdiction.
It moves the question off the tool and onto you. Every skill listed here is public, free and legal to download. What determines whether running one is fine or a problem is entirely what you point it at — which is why the clips that describe these repos as reverse engineer anything are describing something nobody shipped.
If you want the broadest coverage and do not mind delegating tool choice, start with the router. If you want to understand each step, start with the focused Android skill — it is smaller and easier to read end to end. For iOS there is currently one real option on this list.
They were read directly from the GitHub API on 13 August 2026, not copied from another article. They will drift. The licenses are the more durable number, and those are listed too.
The router advertises support for several coding clients, not only Claude Code. The others are packaged as Claude Code skills. In practice they are prompt and script bundles, so porting is usually possible, but nothing here is guaranteed to work unchanged elsewhere.
No. Every repo listed is open source, and this page is free. No sign-up.
Building AI at your company? Eight Labs consults for enterprise, SMEs and startups. Details at theaihow.com.