android-legacy-security

Harden Intent handling, WebView configuration, and FileProvider access in Android apps. Use when securing Intent extras, configuring WebViews, or exposing files via FileProvider; defer manifest export flags and generic Bundle typing to focused Android security guidance.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, well-structured hardening checklist that offloads executable examples to a real, one-level-deep reference file. Its main weakness is workflow clarity: it presents parallel standards rather than a sequenced procedure with validation checkpoints, and the most actionable code lives only in the reference.

Suggestions

Add a short sequenced hardening procedure (e.g. audit manifest exports -> lockdown WebViews -> verify FileProvider usage) with an explicit validation/check step so reviewers can confirm each standard is applied.

Inline one minimal copy-paste example for the highest-impact pattern (e.g. a FileProvider <provider> snippet or WebView settings block) so the most common case is actionable without opening the reference.

Cross-link the Anti-Patterns section to the relevant numbered standard to make navigation between rules and anti-patterns explicit.

Dimension	Reasoning	Score
Conciseness	The body is a lean bullet checklist of hardening rules with no padding or explanation of concepts Claude already knows (what an Intent or WebView is). Every line earns its place and concrete config names are surfaced directly. Matches the 5 'lean and efficient' anchor.	5 / 5
Actionability	Gives concrete, named configuration values — 'android:exported="false"', 'javaScriptEnabled = false', 'allowFileAccess', 'content:// URIs', 'EncryptedSharedPreferences', 'NetworkSecurityConfig' — that are directly applicable. Not a 5 because full executable code lives in the reference file rather than inline, leaving minor gaps for the highest-impact patterns.	4 / 5
Workflow Clarity	Content is organized by area (Intents, WebViews, Storage) with a P0 priority label, but there is no multi-step sequence or validation checkpoint — it is a standards checklist, not a sequenced hardening procedure. Fits the 3 anchor 'steps listed but checkpoints missing'; not 4 because no verification/feedback loop is present.	3 / 5
Progressive Disclosure	SKILL.md is a concise overview with clearly signaled one-level-deep references to references/implementation.md, which exists and holds the executable examples. Content is appropriately split and easy to navigate, matching the 5 anchor.	5 / 5
	Total	17 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concise, third-person, and answers both what and when with concrete, natural trigger terms and an explicit scope boundary to reduce conflict. It is strong throughout, with only minor room to add more natural synonyms and surface the storage/network hardening actions.

Dimension	Reasoning	Score
Specificity	Names the domain plus several concrete actions — 'Harden Intent handling, WebView configuration, and FileProvider access' — with only minor coverage gaps (e.g. NetworkSecurityConfig/EncryptedSharedPreferences not surfaced here). Not a 5 because the action list stops at three areas rather than being comprehensive.	4 / 5
Completeness	Explicitly answers both 'what' (Harden Intent handling, WebView configuration, FileProvider access) and 'when' ('Use when securing Intent extras, configuring WebViews, or exposing files via FileProvider') with concrete trigger phrases. The added defer clause sharpens the when; clearly matches the 5 anchor.	5 / 5
Trigger Term Quality	Includes natural phrases a user would say — 'securing Intent extras', 'configuring WebViews', 'exposing files via FileProvider' — but misses common synonyms like 'deep links', 'cleartext traffic', or 'content URI'. Good coverage but a few natural terms absent, so 4 not 5.	4 / 5
Distinctiveness Conflict Risk	Clear Android-security niche with distinct Intent/WebView/FileProvider triggers, plus an explicit defer boundary ('defer manifest export flags and generic Bundle typing to focused Android security guidance') that minimizes overlap. Minimal conflict risk, matching the 5 anchor.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: HoangNguyen0403/agent-skills-standard
Path: skills/android/android-legacy-security/SKILL.md
Commit: 405cdd5

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.