# Apk Deeplink Hunt

> Find and validate Android deep links in decompiled APKs (apktool/jadx outputs). Use when you need to identify intent-filter schemes/hosts/paths, internal route patterns, and required parameters, then test candidates with adb.

- Skill: `flsrg/apk-deeplink-hunt` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add flsrg/apk-deeplink-hunt`
- Raw SKILL.md: https://api.skillmd.com/api/skills/flsrg/apk-deeplink-hunt/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: flsrg (https://skillmd.com/u/flsrg)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/flsrg/apk-deeplink-hunt

---


# Apk Deeplink Hunt

## Overview

Identify deep link entry points and routing rules in decompiled APKs, then build and test candidate links that open specific screens or prefill fields.

## Workflow

### 1) Establish inputs and scope
- Confirm decompile outputs (apktool + JADX paths) and the target flows/screens.
- Note the package name if you plan to target with adb.

### 2) Extract public deep link entry points
- Scan manifest for VIEW intent filters and data rules:
  - `rg -n "intent-filter|ACTION_VIEW|VIEW" out-apktool/AndroidManifest.xml`
  - `rg -n "data android:scheme|data android:host|data android:path|data android:pathPrefix|data android:pathPattern" out-apktool/AndroidManifest.xml`
- Record schemes, hosts, and path patterns.

### 3) Find the deep link router and normalization
- Locate the main activity and deep link handler:
  - `rg -n "ACTION_VIEW|getIntent\\(|deep link|deeplink" out-jadx/sources`
- Locate scheme normalization (custom schemes to https):
  - `rg -n "normalize|scheme|kaspikz|kaspi" out-jadx/sources`
- Note which schemes are accepted and how they are normalized.

### 4) Locate route patterns and screen selectors
- Search for route regex patterns like `action://.../(.*)` and for route keywords:
  - `rg -n "action://|route|pattern|deeplink" out-jadx/sources`
- Identify special segments (e.g., `focusCard`, `focusPhone`, `confirm`) and map them to screens.

### 5) Identify parameter keys for prefills
- Search for parameter key strings in validation or UI models:
  - `rg -n "cardNumber|phoneNumber|amount|transferAmount|targetCardNumber" out-jadx/sources`
- Capture the exact key names used by the flow.

### 6) Build candidate deep links
- Combine host/path pattern + route segment + query parameters.
- Prefer HTTPS if it is in the manifest; add custom schemes if present.

Example patterns:
- `https://<host>/<path>/<segment>?key=value`
- `<scheme>://<host>/<path>/<segment>?key=value`

### 7) Validate with adb
- Use the exact command format and confirm the resulting screen:
  - `adb shell am start -W -a android.intent.action.VIEW -d "deep_link_here"`
- If a link routes incorrectly, try:
  - Alternative scheme (custom vs https)
  - Different host that is listed in the manifest
  - Alternate parameter key (only if supported by the code)

### 8) Record results
- Write confirmed links into the target output file (e.g., `Deeplinks.txt`).
- Include required parameters and any notes (login required, optional amount, etc.).

## References

Use this when you want a concise checklist and example patterns:
- `apk-deeplink-hunt/references/checklist-and-examples.md`

## Examples

Sample user prompts for this skill:
- `apk-deeplink-hunt/examples/example-prompts.md`