rea
Reverse engineer anything with agents, from app behavior down to native binaries.
460k
@morlutoSecurity
Plugin
jar-analyzer-claude
A Claude Code plugin for static analysis and security auditing of Java JAR and WAR packages. It builds a SQLite analysis database and runs audit queries such as method call tracing and vulnerability pattern detection.
Plugin Signal31/100Fair
maintained20
capable23
documented50
adopted46
Claude Code
> /plugin marketplace add jar-analyzer/jar-analyzer-claude> /plugin install jar-analyzer-plugin@jar-analyzer-marketplace
Codex
$ npx skills add jar-analyzer/jar-analyzer-claude -a codex
Cursor
$ npx skills add jar-analyzer/jar-analyzer-claude -a cursor
Gemini CLI
$ npx skills add jar-analyzer/jar-analyzer-claude -a gemini-cli
GitHub Copilot
$ copilot plugin marketplace add jar-analyzer/jar-analyzer-claude$ copilot plugin install jar-analyzer-plugin@jar-analyzer-marketplace
OpenCode
$ npx skills add jar-analyzer/jar-analyzer-claude -a opencode
Windsurf
$ npx skills add jar-analyzer/jar-analyzer-claude -a windsurf
What's inside
README
jar-analyzer-claude
基于 jar-analyzer 的 Claude Code 插件，用于 Java JAR/WAR 包静态分析与安全审计。
✨ 功能特性
- 🗄️ 构建分析数据库 — 从 JAR/WAR/Class 文件构建 SQLite 数据库，提取类信息、方法调用关系、继承关系等
- 🔍 安全审计分析 — 检测 RCE、SQL 注入、SSRF、反序列化等常见漏洞模式
- 🔗 方法调用链追踪 — 从危险 sink 回溯到 HTTP 入口，验证漏洞可达性
- 📝 反编译验证 — 内置 FernFlower 反编译器，快速查看可疑代码
- 🌱 Spring 组件分析 — 自动识别 Controller、Mapping、拦截器等组件
- 🔑 敏感信息检测 — 搜索硬编码密码、密钥、JNDI 地址等
📦 安装
一行命令添加插件市场：
/plugin marketplace add https://github.com/jar-analyzer/jar-analyzer-claude
添加完成后，在插件市场中选择 jar-analyzer-plugin 进行安装。
⚠️ 插件内置了打包好的
jar-analyzer-engine，文件较大，下载可能需要一些时间，请耐心等待。
🚀 使用方法
第一步：构建数据库
使用 /build-db 命令，指定需要审计分析的 JAR/WAR 文件，构建分析数据库。
💡 建议在空目录中执行，分析完成后当前目录下会生成
jar-analyzer-temp临时目录和jar-analyzer.db数据库文件。
第二步：执行安全分析
使用 /do-analyze 命令，对数据库执行安全审计查询（优先使用 sqlite3 命令，其次回退到 python 脚本）。
第三步：查看审计报告
分析完成后，自动生成详细的安全审计报告，坐等结果即可。
🛠️ 环境要求
| 依赖 | 版本 | 用途 |
|---|---|---|
| Java | 8+ | 运行分析引擎和反编译 |
| Python | 3+（可选） | 执行 SQL 查询脚本（作为 sqlite3 的备选方案） |
🙏 致谢
- jar-analyzer — 4ra1n
Stars on GitHub
Momentum
- stars in total
- 141
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills45k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook27k
@guillaumemeyerQuestions about jar-analyzer-claude.
A Claude Code plugin for static analysis and security auditing of Java JAR and WAR packages. It builds a SQLite analysis database and runs audit queries such as method call tracing and vulnerability pattern detection. Install it with the command on its page. It includes build-db, do-analyze. Its skills do not fire on their own yet. Free and open source.
- What is jar-analyzer-claude?
- A Claude Code plugin for static analysis and security auditing of Java JAR and WAR packages. It builds a SQLite analysis database and runs audit queries such as method call tracing and vulnerability pattern detection.
- How do I install jar-analyzer-claude?
- Run these in Claude Code: /plugin marketplace add jar-analyzer/jar-analyzer-claude then /plugin install jar-analyzer-plugin@jar-analyzer-marketplace. Then prompt normally.
- Does jar-analyzer-claude auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin.
- Is jar-analyzer-claude free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use jar-analyzer-claude's skills?
- jar-analyzer-claude installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it