Security

Skill piyushverma0/android-agent-skills/skills/security

27 Android skills for AI agents (Claude Code, Codex, Cursor). Fixes Supabase auth, Hilt errors, design inconsistency, kapt→ksp, missing UiState states. Reduced my token bills 5×. FitGenZ AI shipped in 18 days.

Install

npx -y skills add piyushverma0/android-agent-skills --skill security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

14 stars14 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Android app security for AI agents. Use this skill whenever implementing secure data storage, EncryptedSharedPreferences, EncryptedFile, Android Keystore, ProGuard/R8 code obfuscation, certificate pinning, network security config, root detection, SSL/TLS, token storage, preventing reverse engineering, securing API keys, BuildConfig secrets, environment variables, cleartext traffic, backup rules, screenshot prevention, overlay attack prevention, or any Android security hardening. Always apply when handling user credentials, payments, or PII.

SKILL.md

4.9 KB, ~1.0k tokens by cl100k_base, as published. Nobody here has run it

Android Security

Rule 1: Never store secrets in source code or BuildConfig

// ❌ Never — committed to git, visible in APK
const val API_KEY = "sk-1234567890abcdef"
buildConfigField("String", "API_KEY", "\"sk-1234567890abcdef\"")

// ✅ Use local.properties (gitignored) + build script injection
// local.properties (never commit this file)
// API_KEY=sk-1234567890abcdef

// build.gradle.kts
val apiKey = gradleLocalProperties(rootDir, providers).getProperty("API_KEY") ?: ""
buildConfigField("String", "API_KEY", "\"$apiKey\"")

// ✅ Better: use server-side proxy — never expose API keys in app at all
// Client → Your backend → Third-party API

Rule 2: Encrypted storage for sensitive data

// ✅ EncryptedSharedPreferences for tokens, session data
class SecureStorageImpl @Inject constructor(
    @ApplicationContext context: Context
) : SecureStorage {
    private val masterKey = MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build()

    private val encryptedPrefs = EncryptedSharedPreferences.create(
        context,
        "secure_prefs",
        masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    )

    override fun saveToken(token: String) {
        encryptedPrefs.edit().putString("auth_token", token).apply()
    }

    override fun getToken(): String? = encryptedPrefs.getString("auth_token", null)

    override fun clearAll() = encryptedPrefs.edit().clear().apply()
}

Rule 3: Network Security Config

<!-- res/xml/network_security_config.xml -->
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Block all cleartext traffic in production -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system" />
        </trust-anchors>
    </base-config>

    <!-- Allow cleartext only for debug -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="system" />
            <certificates src="user" />  <!-- allow Charles/mitmproxy in debug -->
        </trust-anchors>
    </debug-overrides>
</network-security-config>

<!-- AndroidManifest.xml -->
<application
    android:networkSecurityConfig="@xml/network_security_config"
    android:usesCleartextTraffic="false">

Rule 4: Certificate pinning

// ✅ OkHttp certificate pinning for high-security apps
val certificatePinner = CertificatePinner.Builder()
    .add("api.myapp.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")  // leaf
    .add("api.myapp.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")  // backup
    .build()

OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build()

Rule 5: Prevent screenshots and screen recording

// ✅ Prevent screenshots on sensitive screens (banking, passwords)
@Composable
fun SecureScreen(content: @Composable () -> Unit) {
    val activity = LocalContext.current as? Activity
    DisposableEffect(Unit) {
        activity?.window?.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
        onDispose {
            activity?.window?.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
        }
    }
    content()
}

Rule 6: Backup rules — exclude sensitive files

<!-- res/xml/backup_rules.xml -->
<?xml version="1.0" encoding="utf-8"?>
<full-backup-content>
    <exclude domain="sharedpref" path="secure_prefs.xml" />
    <exclude domain="database" path="app_database" />
    <exclude domain="file" path="." />
</full-backup-content>

<!-- AndroidManifest.xml -->
<application
    android:allowBackup="false"
    android:dataExtractionRules="@xml/backup_rules">

Common Mistakes

❌ Storing tokens in plain SharedPreferences — use EncryptedSharedPreferences ❌ API keys in BuildConfig — visible by decompiling APK ❌ android:allowBackup="true" without backup rules — sensitive DB backed up to Google ❌ android:usesCleartextTraffic="true" in production — all traffic unencrypted ❌ Logging tokens or PII in debug — Log.d("token", userToken) visible in logcat ❌ No root detection for banking/payment apps — use Play Integrity API

Gives 0 of the 12 instructions most security skills give in ~1.0k tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-07

parameterize all database queriesin 68 of 648, across 51 files
hash passwords using bcrypt scrypt or argon2in 49 of 648, across 36 files
apply rate limiting to authentication endpointsin 48 of 648, across 24 files
Configure security headersin 35 of 648, across 19 files
validate all inputsin 32 of 648, across 24 files
validate all external input at the system boundaryin 29 of 648, across 19 files
run containers as a non-root userin 28 of 648, across 15 files
use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
run dependency audits before every releasein 21 of 648, across 10 files
encode output to prevent cross-site scriptingin 21 of 648, across 11 files
copy dependencies before source codein 20 of 648, across 9 files
store secrets in environment variablesin 20 of 648, across 18 files

Said here and by no other author read

use server-side proxies for API keys
store sensitive data in EncryptedSharedPreferences
block cleartext traffic in production
pin certificates for high-security apps
prevent screenshots on sensitive screens
disable backups without exclusion rules

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.