# build artifacts
*.class
*.jar
!skills/apk-reverse/scripts/dexpatch/*.java

# working data -- never commit samples or outputs
*.apk
*.aab
*.dex
*.odex
*.vdex
*.oat
*.so
*.jks
*.keystore
*.pk8
*.pem
*.p12

# local scratch
_tmp/
out/
work/
audit_out/

# local extension-pass workspace: toolchains, device archives, dumped images, scratch notes.
# Nothing under tools/ belongs to the repository -- the skill's own evidence record lives in
# docs/tool-verification/ and carries no target identity or vendored binaries.
tools/

# local input material (the reporting sample and the analysis notes it came with)
存在问题和例子/

# Local copies of the third-party write-ups an absorption pass reads. They are someone else's
# text, not content of this repository: what ships is the absorbed method under an `inferred`
# label, plus the anonymized source line in docs/tool-verification/EXTENSION-absorption-*.md.
# One `git add -A` is all it would take to commit them, so the rule is explicit here rather than
# resting on "nobody has added them yet".
.ref/

# sandbox installs made while testing `npx skills add .` against this repo
.claude/
.agents/
*.log
*.jsonl
*.pcap
*.png
*.jpg

# python / editors
__pycache__/
*.pyc
.venv/
.vscode/
.idea/
.DS_Store

# local input material -- the same rule as 存在问题和例子/: the reports these passes are based on
# are the user's material, not content of this repository
新的建议和思路/
朋友全面审查和建议/