Most security products that mention AI leave one question unanswered: what exactly does the model decide? In malware analysis that question matters more than anywhere else, because a verdict has to be defensible. An analyst who blocks an app, escalates an incident or signs off on a vendor review needs to point at evidence, not at a paragraph a model wrote.
Droidwatch uses a large language model in exactly two places, and neither of them produces the verdict:
- The report assistant ("Ask AI"). A chat panel inside every report that answers questions about that report in plain language: what the app does, why it received its verdict, what to block and what to do next.
- The skill for AI assistants. A thin client that lets an assistant such as Claude Code upload an APK to Droidwatch, wait for the analysis and return the verdict, the command-and-control infrastructure and the key findings, without leaving the chat.
The two solve different problems. The skill answers is this APK malicious? The assistant answers why, and what now? This article documents both: what each one reads, what it returns, what reaches the model, which plans include it, and where the line sits between AI output and analysis evidence.
Where the verdict comes from
The verdict is produced by the analysis pipeline, and nothing described in this article changes it.
A single upload runs a 28-stage pipeline that produces more than 25 independent analyses: manifest and certificate parsing, comparison against Google Play, DEX bytecode analysis, native code and packer detection, YARA-based family detection, supply-chain checks and C2 extraction. A machine-learning classifier runs alongside it, measured at macro F1 0.9873 on a 1,661-sample holdout, trained on 6,642 samples from CICMalDroid 2020. The classifier contributes one signal to the score; it does not decide it.
The result is a risk score from 0 to 100, where higher is worse, with fixed cut-offs: 65 or more is Malicious, 40-64 High Risk, 20-39 Suspicious and below 20 Benign.
The prose fields in the report, narrative and behavior_summary, are also not written by a language model. They come from a rule engine: a phase of the attack chain appears only when findings support it. That design choice predates the assistant and is the reason the assistant can be added safely. The evidence layer stays deterministic, and the language model sits on top of it as a reader.
The full structure of a report is covered in Inside a Droidwatch report.
The report assistant
What it is
Every report has a floating button in the bottom-right corner labelled Ask AI. It opens a chat panel (full screen on mobile) attached to that report, headed "Ask the report anything". The panel offers starter questions, and they show what the assistant is for:
- What does this app actually do?
- Why did it get this verdict?
- What should I block on my firewall?
- Explain it to someone non-technical.
The assistant has read the whole report. It answers by citing the report's own findings, and when a question needs more detail it reads the relevant sections: permissions, components, URLs, C2 indicators and the rest of sections[]. It answers in the language the question is asked in, so a Spanish-speaking analyst and a Portuguese-speaking executive can work from the same English-language report.
What it does not do
The assistant never changes the verdict. The score and the verdict come from the analysis pipeline. The assistant is a reader of the report, not a second engine, and it has no channel to rescore a sample, add a finding or remove one.
This matters for how its output should be used. An answer from the assistant is an explanation of evidence that already exists in the report. When the answer is going into an incident record, the citation should be the finding the assistant pointed to, not the assistant's sentence.
Who it is for
Reports are written for analysts. Many of the people who need to act on a report are not analysts: the fraud lead who has to decide whether to warn customers, the product owner whose app shares a supply-chain finding, the compliance officer who has to file a note. The usual workaround is an analyst rewriting the report by hand for each audience. The assistant replaces that step with a question: explain it to someone non-technical, what should the help desk tell a customer who installed this, which of these findings applies to our own app.
It also shortens the analyst's own work on unfamiliar ground. A reverse engineer who knows Android internals well may not know what a given ATT&CK Mobile technique implies operationally, or why a specific certificate anomaly matters. Asking the report is faster than cross-referencing three tabs.
Plans and quotas
The assistant is included in Pro, Team and Enterprise. On Free and without an account, the panel is visible but locked.
| Plan | Questions per month | Questions per report |
|---|---|---|
| Pro | 40 | up to 20 |
| Team | 120 | up to 20 |
| Enterprise | 200 | up to 20 |
The conversation is saved with the report, so it is there when the report is reopened, and it is deleted when the report is deleted.
What reaches the model
The model behind the assistant is Claude, by Anthropic, listed as a sub-processor in the privacy policy.
What is sent, and when, is narrow:
- Nothing is sent until a question is asked. Opening a report does not send anything to the model.
- When a question is asked, the model receives the question, the report summary and the parts of the report it reads to answer.
- The APK is never sent. Neither are the account identity or the email address.
The model receives the report, not the sample. For organisations that analyse customer-submitted applications, this is the relevant boundary: the binary stays on Droidwatch's servers, and the assistant only ever sees the analysis output.
The skill for AI assistants
What it is
The skill is for the other end of the workflow: the moment someone asks is this APK malicious? and wants the answer where they are already working. It is a single Python file with no dependencies, packaged as a skill for AI assistants. The assistant uploads the file to Droidwatch, polls until the job finishes and returns a compact result of about 8 KB. The analysis runs on Droidwatch's servers, through the same pipeline as a browser upload.
The result contains:
- the verdict and score;
- critical and high findings, prioritised;
- decrypted C2 indicators, when extraction succeeds;
- MITRE ATT&CK Mobile techniques;
- a MASVS security-posture scorecard;
- whether the sample resists instrumentation;
- stages that did not complete;
- sections withheld by the plan.
Two of those fields exist so the assistant does not overstate the result. "Stages that did not complete" and the distinction between could not be checked and nothing found keep a summary from implying a clean result when checks were skipped.
Installing it
The skill is downloaded as a zip from https://droidwatch.app/ci/claude-skill/droidwatch-skill.zip and unzipped into the assistant's skills folder; for Claude Code that is ~/.claude/skills/. The only requirement is Python 3. There is no public repository to clone. Setup steps are in the skill documentation.
Plans and limits
The skill is not gated by plan and works without an API key, in anonymous mode. A key raises the limits; it does not unlock access. Keys are created in the web app under My Profile → API Keys, with the read + analyze scope.
| Mode | Analyses per day | Maximum file size |
|---|---|---|
| Anonymous (no key) | 3 | 150 MB |
| Free account | 5 | 200 MB |
| Pro | 100 | 500 MB |
| Team | 500 | 750 MB |
| Enterprise | No cap | 1 GB |
Analysis time depends on size: a 50 MB APK takes two to five minutes, and packages over 100 MB average eight to ten.
Scope
The skill is built for identifying malicious apps and the infrastructure behind them. It is not a tool for auditing vulnerabilities in one's own application; that work belongs in the full report or in a CI/CD scan. It also should only be used on software the user has the right to analyse.
Choosing between them
| Skill for AI assistants | Report assistant | |
|---|---|---|
| Question it answers | Is this APK malicious? | Why this verdict, and what now? |
| Where it runs | The user's AI assistant | Inside the Droidwatch report |
| Input | An APK file | A finished report |
| What reaches a model | The compact result, in the user's own assistant | The question and the report content it needs; never the APK |
| Plan | Any, including no account | Pro, Team and Enterprise |
| Typical user | Analyst or developer doing first-pass triage | Analyst, fraud lead, manager or auditor acting on a result |
In practice they chain. A suspicious APK arrives in a ticket; the analyst runs the skill from the chat and gets a High Risk verdict with a C2 domain. The full report is opened in Droidwatch, and the assistant is asked what the C2 indicators imply for the network team and how to explain the finding to the business owner. The triage took one message; the explanation took two questions.
Principles behind the design
The choices above follow from a few rules that apply to every AI feature in the product:
- Evidence is deterministic. Findings, the score and the verdict come from the pipeline and the rule engine. A language model reads them; it does not produce them.
- The model sees the minimum. The report content the question needs, never the binary and never the account identity.
- Limits are stated. Skipped checks are reported as skipped, the per-plan quotas are published, and the assistant's role is described as explanation, not detection.
For a security tool, the value of AI is not that it finds malware a pipeline cannot. It is that the people who need to act on the pipeline's output can understand it without waiting for an analyst to translate.
Frequently asked questions
Does AI detect the malware in Droidwatch? No. Detection is done by the 28-stage analysis pipeline, including a machine-learning classifier that contributes one signal to the score. The AI assistant reads the finished report and explains it. It cannot change the verdict.
Is the APK sent to the language model? No. When a question is asked, the model receives the question, the report summary and the report sections it needs. The APK, the account identity and the email address are not sent.
Which model does the assistant use? Claude, by Anthropic, listed as a sub-processor in the privacy policy.
Can the assistant be used on the Free plan? No. It is included in Pro, Team and Enterprise. On Free and without an account the panel is visible but locked.
Does the skill need a paid plan or an API key? No. It works anonymously with three analyses a day. A key from any plan raises the limits.
Which assistants does the skill work with? It installs wherever an assistant reads skills from; the documentation covers Claude Code.
Where are the conversations stored? With the report. They are deleted when the report is deleted.
Analyze an APK or read the skill documentation.