How do I install the Jadx skill?

Run npx skillmds@latest add aeondave/jadx in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Jadx skill do?

Auth/lab ref: Android Dex-to-Java decompiler with CLI and GUI support. It is listed under Coding & Dev Tools on SkillMD.

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Jadx?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Jadx by aeondave — Agent Skill

Name: Jadx
Author: AeonDave

File contents

JADX

Readable Android decompilation with both CLI and GUI workflows.

When to use JADX

Use JADX when you want to:

read application logic quickly in Java-like form
inspect classes, methods, and strings from APK/DEX/AAB/JAR files
export a Gradle-like project for deeper review
deobfuscate names or isolate one class without rebuilding anything

Use apktool when you need to edit and rebuild the APK.

Quick Start

# CLI decompile to folder
jadx -d out app.apk

# Open GUI for interactive analysis
jadx-gui app.apk

# Export as Gradle-like project
jadx -e -d out app.apk

High-Value Flags

Flag	Purpose
`-d, --output-dir`	Write decompiled output to a directory
`-e, --export-gradle`	Export a Gradle-like project
`--show-bad-code`	Keep inconsistent code instead of hiding it
`--deobf`	Enable deobfuscation
`--single-class`	Decompile only one class
`--single-class-output`	Write single-class output to file or dir
`--output-format json`	Emit JSON instead of Java output
`--cfg` / `--raw-cfg`	Export control-flow graphs
`-q` / `-v`	Quiet or verbose logging

Common Workflows

Fast APK triage

jadx -d out app.apk

Then inspect:

sources/ for business logic
resources/AndroidManifest.xml
suspicious packages, hardcoded endpoints, auth logic, root checks

Interactive GUI review

jadx-gui app.apk

Best for:

cross-reference browsing
full-text search
jumping between call sites
comparing decompiled code and resources quickly

Handle ugly or obfuscated output

jadx --deobf --show-bad-code -d out app.apk

Use this when normal output hides code paths or when identifiers are too mangled.

Isolate one class

jadx --single-class com.example.auth.LoginActivity app.apk

Useful when you already know the package/class name from logs, manifest, or previous triage.

Practical Notes

JADX explicitly warns that it cannot decompile every app perfectly; always verify sensitive logic in smali if output looks suspicious.
Use jadx-gui first for orientation, then rerun CLI with focused flags for reproducible output.
If imports or dependencies are broken, analyze the whole project root rather than one isolated file when possible.
For final patching, move from jadx to apktool or direct smali edits.

Caveats

Decompiled Java is an approximation, not source-of-truth.
Obfuscated Kotlin apps may still require fallback mode or smali verification.
If integrity or control-flow logic matters, cross-check with apktool smali or another RE tool.

Resources

No bundled scripts/, references/, or assets/. Use the official README and wiki for plugin management, GUI-specific features, and advanced renaming options.

---name: jadxdescription: Auth/lab ref: Android Dex-to-Java decompiler with CLI and GUI support.license: Apache-2.0---# JADXReadable Android decompilation with both CLI and GUI workflows.## When to use JADXUse JADX when you want to:- read application logic quickly in Java-like form- inspect classes, methods, and strings from APK/DEX/AAB/JAR files- export a Gradle-like project for deeper review- deobfuscate names or isolate one class without rebuilding anythingUse `apktool` when you need to **edit and rebuild** the APK.## Quick Start```bash# CLI decompile to folderjadx -d out app.apk# Open GUI for interactive analysisjadx-gui app.apk# Export as Gradle-like projectjadx -e -d out app.apk```## High-Value Flags| Flag | Purpose ||------|---------|| `-d, --output-dir` | Write decompiled output to a directory || `-e, --export-gradle` | Export a Gradle-like project || `--show-bad-code` | Keep inconsistent code instead of hiding it || `--deobf` | Enable deobfuscation || `--single-class` | Decompile only one class || `--single-class-output` | Write single-class output to file or dir || `--output-format json` | Emit JSON instead of Java output || `--cfg` / `--raw-cfg` | Export control-flow graphs || `-q` / `-v` | Quiet or verbose logging |## Common Workflows### Fast APK triage```bashjadx -d out app.apk```Then inspect:- `sources/` for business logic- `resources/AndroidManifest.xml`- suspicious packages, hardcoded endpoints, auth logic, root checks### Interactive GUI review```bashjadx-gui app.apk```Best for:- cross-reference browsing- full-text search- jumping between call sites- comparing decompiled code and resources quickly### Handle ugly or obfuscated output```bashjadx --deobf --show-bad-code -d out app.apk```Use this when normal output hides code paths or when identifiers are too mangled.### Isolate one class```bashjadx --single-class com.example.auth.LoginActivity app.apk```Useful when you already know the package/class name from logs, manifest, or previous triage.## Practical Notes- JADX explicitly warns that it cannot decompile every app perfectly; always verify sensitive logic in smali if output looks suspicious.- Use `jadx-gui` first for orientation, then rerun CLI with focused flags for reproducible output.- If imports or dependencies are broken, analyze the whole project root rather than one isolated file when possible.- For final patching, move from `jadx` to `apktool` or direct smali edits.## Caveats- Decompiled Java is an approximation, not source-of-truth.- Obfuscated Kotlin apps may still require fallback mode or smali verification.- If integrity or control-flow logic matters, cross-check with `apktool` smali or another RE tool.## ResourcesNo bundled `scripts/`, `references/`, or `assets/`.Use the official README and wiki for plugin management, GUI-specific features, and advanced renaming options.

Frequently asked questions

Jadx