# How to check what an Android APK declares and does with rea

Repo: [morluto/rea](https://github.com/morluto/rea) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Inspect an APK's manifest, classes and decompiled methods to see what the app declares.

**Who it is for:** IT admin or security reviewer vetting an Android app before approving it for staff devices

**The problem:** You cannot tell what permissions and components an APK declares or how its key methods behave.

**The outcome:** A report of manifest declarations, classes and decompiled methods you can review.

## Steps

1. Install headless JADX if you do not have it.
2. Run npx rea-agents setup and restart your agent.
3. Ask the agent to analyze the APK with REA and list manifest declarations.
4. Ask it to decompile and explain the methods that handle the behavior you worry about.

## Prompt to paste into your agent

```text
Use REA to analyze the APK at <path to apk>, list its manifest declarations and explain what <suspicious behavior> does in the decompiled methods. Verify each claim cites a class or method.
```

## Caveat

APK analysis depends on JADX being available. Only inspect apps you are authorized to review; decompiled output is an approximation of the original code.

Dual-use notice: only use this on software, sites and systems you own or are authorized to test.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/morluto-rea/audit-android-apk-manifest/