Android security
Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/android-security
Standards for Data Encryption, Network Security, and Permissions. Load whenever API keys, auth tokens, cleartext traffic, android:exported, EncryptedSharedPreferences, certificate pinning, or root detection come up — even if the user just asks 'is this secure'. (triggers: network_security_config.xml, AndroidManifest.xml, EncryptedSharedPreferences, cleartextTrafficPermitted, intent-filter, api key, token storage, certificate pinning, root detection, secure storage)From its SKILL.md
npx -y skills add ComeOnOliver/skillshub --skill android-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
SKILL.md
1.6 KB, 248 tokens by cl100k_base, as published. Nobody here has run it
Android Security Standards
Priority: P0 (CRITICAL)
Implementation Guidelines
Data Storage
- Secrets: NEVER store API keys in code. Use
EncryptedSharedPreferencesfor sensitive local data (Tokens). - Keystore: Use Android Keystore System for cryptographic keys.
Network
- HTTPS: Enforce HTTPS via
network_security_config.xml(cleartextTrafficPermitted="false"). - Pinning: Consider Certificate Pinning for high-security apps.
Component Export
- Exported: Explicitly set
android:exported="false"for Activities/Receivers unless intended for external use.
Anti-Patterns
- No Sensitive Logs: Strip logs in Release builds.
- No Homebrew Root Detection: Use Play Integrity API instead.
- No Raw URL String Concatenation: Use
Uri.BuilderorHttpUrl(OkHttp) to prevent parameter injection.
References
- Setup Examples
- [common/common-security-standards] — shared OWASP baselines
- [android/android-legacy-security] — Intent, WebView, and FileProvider hardening
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.