Molt Dex
Reverse-engineer and assess Android apps, from unobfuscated to heavily obfuscated, using a staged, evidence-first pipeline built on apktool, adb and scrcpy. Use when the user wants to understand how an APK is built, what it does, where its secrets and misconfigurations are, or wants to drive an app on a device to observe its behaviour. Dynamic testing (anything that touches a running system or backend) is authorization-gated and must be in scope.
Install
npx skills add ReSo7200/molt-dex --skill molt-dexgit clone --depth 1 https://github.com/ReSo7200/molt-dex.git /tmp/molt-dex
mkdir -p ~/.claude/skills
cp -r /tmp/molt-dex/. ~/.claude/skills/molt-dexPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# molt-DEX A pipeline for taking an Android app from "here is an APK (or an installed package)" to "here is how it is built, how it behaves, and where its weaknesses are." It works on a spectrum from plain apps to ones with name obfuscation, string encryption, packing and anti-tamper. It reasons over **apktool**-decoded smali and resources (not a Java decompile), confirms on a device with **adb** + **scrcpy**, and cites evidence for every claim. ## Before anything: what kind of work is this? Load `references/00-authorization.md` first, every session. The line that matters is not "static vs dynamic", it is **self-contained work vs reaching other people's systems**: - **Static analysis** of an artifact the user supplied: always fine. (`local_allowed`) - **Local modding and on-device analysis** on your own device and account, installing, driving the UI, instrumenting with Frida / LSPosed / LSPatch, and building a module that changes how your own copy behaves: fine, no pentest authorization needed. This is how the Instagram work was done. (`local_allowed`) - **Assessment of a target** that reaches beyond your own instance (sending crafted traffic to backends to test them, probing another account, a pentest / VA you were engaged for): **gated**. State the target, basis, and scope, and record it in an engagement log. (`assessment_allowed`) Refuse, regardless of stated purpose: touching accounts/data that are not the user's own and not
Details
- Skill name
molt-dex- Repository
- ReSo7200/molt-dex
- License
- MIT
- Repo updated
- 17 October 2026
FAQ
What does the Molt Dex skill do?
Reverse-engineer and assess Android apps, from unobfuscated to heavily obfuscated, using a staged, evidence-first pipeline built on apktool, adb and scrcpy. Use when the user wants to understand how an APK is built, what it does, where its secrets and misconfigurations are, or wants to drive an app on a device to observe its behaviour. Dynamic testing (anything that touches a running system or backend) is authorization-gated and must be in scope.
How do I install the Molt Dex skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add ReSo7200/molt-dex --skill molt-dex. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Molt Dex popular?
It lives in ReSo7200/molt-dex, which has 23 GitHub stars and 4 forks.
Related skills
Sketch Narrator
22qingyabailu-git/SketchNarrator
从中文主题、文案、视频链接、本地音视频或参考角色制作带自然配音、真实音频时间、分区笔迹和内部成片 QA 的完整手绘讲解视频。适用于素材转口播、黑板讲解、白板科普、故事口播和系列 IP 手绘视频；不用于纯 AI 视频模型生成或复杂 Web 工作台建设。
Premortem
30b1rdmania/claude-premortem-skill
Run a premortem on any plan, launch, product, hire, strategy, or decision. Imagines it failed 6 months from now, works backward to find every reason why, then produces a revised plan. Triggers include "premortem this", "premortem my", "what could kill this", "stress test this plan", "find the blind spots", "poke holes in this", "where will this break", "am I missing anything", "what could go wrong", "future-proof this", "devil's advocate this".
Zod
24anivar/zod-skill
Zod v4 best practices, patterns, and API guidance for schema validation, parsing, error handling, and type inference in TypeScript applications. Covers safeParse, object composition, refinements, transforms, codecs, branded types, v3→v4 migration, and testing schemas with Jest or Vitest. Baseline: zod ^4.6.0. Triggers on: zod imports, z.object, z.string, z.infer, safeParse, mentions of "zod", "schema validation", "zod v4", "z.enum", or testing a schema — "schema test", "zod mock", zod-schema-faker.
Vibe Testing
24knot0-com/vibe-testing
This skill should be used when the user asks to "test my specs", "validate my design docs", "find gaps in my architecture", "stress-test the spec", "vibe test", "pressure test the docs", or mentions spec validation before implementation begins.
Concept Reel
25Jogzh/concept-reel
使用 Canvas、Playwright 和 FFmpeg 制作或修改无旁白的横屏字幕知识短片，支持 15 种动态设计风格、内容驱动分镜、确定性动画、预览与音效合成。适用于把概念或机制做成可理解的动画；有人声口播、实拍和生成模型视频不属于这套引擎的工作流。
Trip Planner
47skywain/trip-planner-skill
End-to-end international trip planning: turns "I want to go to X for N days" into a verified, bookable plan — route skeleton across cities, flight price scans (international + domestic legs), train-vs-fly decisions, hour-by-hour daily timelines with opening hours, dwell times, holiday collisions and tappable turn-by-turn map links (小时级行程+地图导航+离线KML), hotel shortlists by neighborhood, budget rollup, and a booking checklist with deep links. Use this whenever the user asks to plan a trip, vacation, itinerary or honeymoon, compare flight dates/prices, pick between cities or routes, schedule a trav
Browse the most popular Claude skills, all testing & qa skills, or write your own with the skills generator.