agentsclimarketplace

Android security best practices

Skill krutikJain/android-agent-skills/.github/skills/android-security-best-practices

Android skills repository for Kotlin, Compose, XML, testing, CI, release work, and legacy upgrades

Install
npx -y skills add krutikJain/android-agent-skills --skill android-security-best-practices

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 14 stars14 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Apply Android app security guidance around secrets, storage, network trust, exported components, and least privilege.

SKILL.md

5.7 KB, ~1.0k tokens by cl100k_base, as published. Nobody here has run it

Android Security Best Practices

When To Use

  • Use this skill when the request is about: android security review, secret handling android app, exported component security android.
  • Primary outcome: Apply Android app security guidance around secrets, storage, network trust, exported components, and least privilege.
  • Read references/patterns.md when you need the attack-surface checklist or the storage/network/component decision matrix.
  • Read references/scenarios.md for manifest, backup, WebView, and release-hardening review paths.
  • Handoff skills when the scope expands:
  • android-modernization-upgrade
  • android-ci-cd-release-playstore

Workflow

  1. Inventory the attack surface first: exported components, intent/deep link entry points, file sharing, WebView usage, local storage, logs, backups, and network trust config.
  2. Remove avoidable risk before hardening details: prefer platform pickers and choosers, internal storage, server-issued short-lived tokens, and least-privilege permissions instead of shipping broad access or long-lived secrets.
  3. Lock the remaining boundaries explicitly with android:exported, component permissions, FileProvider, networkSecurityConfig, debug-only trust anchors, and immutable PendingIntents.
  4. Review sensitive surfaces that often regress in Android apps: WebView JavaScript bridges, backup/data extraction rules, cleartext exceptions, log redaction, and same-developer IPC assumptions.
  5. Validate the release posture with reproducible checks, then document residual risks and whether backend enforcement or Play Integrity is advisory or blocking.

Guardrails

  • Treat client-side secrets as recoverable by attackers; move trust decisions and privileged API access server-side whenever possible.
  • Export components only when there is a real external caller, and permission-protect or signature-protect them when the contract is private.
  • Use network security config to scope debug trust anchors or cleartext exceptions instead of broad manifest toggles.
  • Redact logs, review backups, and keep sensitive data out of shared external storage by default.

Anti-Patterns

  • Hiding API keys in resources, the NDK, or obfuscation and calling that secure.
  • Leaving android:exported or intent filters ambiguous on launchable or IPC components.
  • Sharing files through raw file paths or overly broad storage permissions instead of FileProvider and system surfaces.
  • Pinning certificates without an operational rotation story or fallback plan.

Review Focus

  • Exported activities, services, receivers, and providers with clear ownership and caller expectations.
  • Secrets, tokens, and backend trust assumptions.
  • Network trust, debug overrides, cleartext usage, and certificate handling.
  • File sharing, backups, logs, and user-data leakage paths.
  • Abuse signals such as Play Integrity only as layered defense, never as the sole authorization model.

Examples

Happy path

  • Scenario: Audit manifests and sharing surfaces for explicit exports, permissions, and FileProvider usage.
  • Command: rg -n "android:exported|android:permission|FileProvider|grantUriPermissions" examples

Edge case

  • Scenario: Catch insecure backup or network defaults before a release candidate goes out.
  • Command: rg -n "networkSecurityConfig|usesCleartextTraffic|allowBackup|fullBackupContent|dataExtractionRules" examples

Failure recovery

  • Scenario: Separate app hardening from modernization or release-pipeline requests.
  • Command: python3 scripts/eval_triggers.py --skill android-security-best-practices

Done Checklist

  • Every externally reachable component has explicit exposure and caller constraints.
  • Secrets, tokens, and trust decisions are not relying on obscurity in the client app.
  • Network, backup, logging, and sharing behavior have explicit release-safe defaults.
  • Residual risks and any backend dependencies are documented with clear follow-up work.

Official References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.