Slash Command

Trailofbits:Scan Apk

Scans Android APKs for Firebase security misconfigurations

Type: Slash Command
Repository: trailofbits/skills
GitHub stars: 7.3k
License: CC-BY-SA-4.0
Repo last updated: Sep 25, 2026
Source file: plugins/firebase-apk-scanner/commands/scan-apk.md

What Trailofbits:Scan Apk is

Trailofbits:Scan Apk is a slash command published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.

Trailofbits:Scan Apk gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.

How to install Trailofbits:Scan Apk

Claude Code

Download scan-apk.md from the repository.
Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
Run it by typing / followed by its name, with arguments such as <apk-file-or-directory>.

Claude Cowork

Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
In Customize → Skills, click +, then upload the ZIP.
Run it from any task with / and the skill name.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/firebase-apk-scanner/commands/scan-apk.md, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Arguments: $ARGUMENTS

Parse the APK file or directory from the arguments. If empty, ask the user for the path.

This command is the entry point for a Firebase APK scan. The firebase-apk-scanner skill sets disable-model-invocation: true, so it cannot be invoked as a skill from here. Read its workflow file and follow it directly.

Resolve the plugin root, then confirm the skill's workflow and scanner are present. The ls echoes the expanded absolute paths, which is how you learn the value to use below:

ls "${CLAUDE_PLUGIN_ROOT}/skills/firebase-apk-scanner/SKILL.md" \
   "${CLAUDE_PLUGIN_ROOT}/skills/firebase-apk-scanner/scanner.sh"

If that fails (under Codex CLAUDE_PLUGIN_ROOT is unset, so the paths collapse to /skills/...), search for the plugin instead:

find ~/.claude ~/.codex . -path '*/plugins/firebase-apk-scanner/skills/firebase-apk-scanner/scanner.sh' -print -quit 2>/dev/null

Strip the trailing /skills/firebase-apk-scanner/scanner.sh to get the root. If neither resolves, stop and report the paths searched — do not continue with an empty root.

Then read /skills/firebase-apk-scanner/SKILL.md and carry out its workflow against the parsed path. Within that workflow, {baseDir} is /skills/firebase-apk-scanner, so {baseDir}/scanner.sh is the scanner confirmed above. $ARGUMENTS appears throughout that file as literal text, not a shell variable — substitute the path you parsed above wherever it occurs, and never run a command with a bare $ARGUMENTS still in it.

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Trailofbits:Scan Apk?

Trailofbits:Scan Apk is a slash command for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Scans Android APKs for Firebase security misconfigurations

How do I install Trailofbits:Scan Apk in Claude Code?

Download scan-apk.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name, with arguments such as <apk-file-or-directory>.

Can I use Trailofbits:Scan Apk in Claude Cowork?

Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.

Is Trailofbits:Scan Apk safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.