ev-flow/quark-engine/analysis

Run Quark Analysis

Use this skill when the user wants to analyze an APK file with Quark Engine. The skill maps the user's analysis request to the correct quark CLI flags, runs the command, and presents the output.

Step 0 — Verify Quark is installed

quark --version

If this fails, stop and tell the user: "Quark not found — run pip install quark-engine and try again."

Step 1 — Identify the APK

Ask the user for the APK path if not provided. Confirm it exists:

test -f "<apk_path>" && echo "OK" || echo "NOT FOUND"

If not found, stop and ask the user to provide the correct path.

Step 2 — Identify the analysis type

Map the user's request to one of the modes below.

Report modes

Modifiers (combine with a report mode)

Utility modes (work without rules installed)

-C comparison mode — requires user interaction

-C opens an interactive terminal dialog that the user must control. Do not try to invoke it automatically. Instead, tell the user:

Label comparison requires interactive input. Run this directly in your terminal:

```

quark -a "<apk_path>" -C

```

Step 3 — Check rules directory (report modes only)

Skip this step for utility modes (-i, -p).

test -d ~/.quark-engine/quark-rules/rules && echo "OK" || echo "MISSING"

If missing: "Rules directory not found — run freshquark to download the latest rules, then try again."

Step 4 — Run the analysis

Before running, print the exact command for the user:

Running: quark -a "<apk_path>" <flags>

Then run it:

bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "<apk_path>" <flags>

Examples:

# Summary report
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s
 
# JSON report to file
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -o report.json
 
# Call graph PNG (requires -s)
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s -g png
 
# List native APIs only (no rules needed)
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -i native
 
# Summary with a custom rules directory
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s -r ~/my-rules/
 
# Run a single rule file
bash "${CLAUDE_PLUGIN_ROOT}/skills/analysis/scripts/run_analysis.sh" "sample.apk" -s path/to/rule.json

Step 5 — Present output and offer next steps

Print the raw quark output verbatim first — do not summarize or paraphrase it. Example of what this looks like for a summary report:

[!] WARNING: Low Risk
[*] Total Score: 1.9
+------------+------------------------------------------------------------+------------+
| Filename   | Rule                                                       | Confidence |
+------------+------------------------------------------------------------+------------+
| 00002.json | Open the camera and take picture                           | 100%       |
| 00010.json | Read sensitive data(SMS, CALLLOG) and put it into JSON     | 100%       |
...
+------------+------------------------------------------------------------+------------+

After the raw output, provide analysis and offer next steps:

• (a) Re-run with a different format or a specific rule file
• (b) Generate a new Quark rule for a suspicious behavior seen in the output — use the `/quark:rule-gen` skill
• (c) Export to JSON: re-run with -o report.json for downstream processing
• (d) View call graph: re-run with -s -g png to visualize which methods triggered a rule