CtrlK
BlogDocsLog inGet started
Tessl Logo

android-security

Secure Android data at rest and authentication secrets. Use for auth tokens, encrypted storage, and app-data isolation; defer WebView/Intent/FileProvider to android-legacy-security and TLS/certificate pinning to android-networking.

64

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/android/android-security/SKILL.md
SKILL.md
Quality
Evals
Security

Android Security Standards

Priority: P0 (CRITICAL)

Implementation Guidelines

Data Storage

  • Secrets: NEVER store API keys in code. Use EncryptedSharedPreferences for sensitive local data (Tokens).
  • Keystore: Use Android Keystore System for cryptographic keys.

Network

  • HTTPS: Enforce HTTPS via network_security_config.xml (cleartextTrafficPermitted="false").
  • Pinning: Consider Certificate Pinning for high-security apps.

Component Export

  • Exported: Explicitly set android:exported="false" for Activities/Receivers unless intended for external use.

Anti-Patterns

  • No Sensitive Logs: Strip logs in Release builds.
  • No Homebrew Root Detection: Use Play Integrity API instead.
  • No Raw URL String Concatenation: Use Uri.Builder or HttpUrl (OkHttp) to prevent parameter injection.

References

  • Setup Examples
  • [common/common-security-standards] — shared OWASP baselines
  • [android/android-legacy-security] — Intent, WebView, and FileProvider hardening
Repository
HoangNguyen0403/agent-skills-standard
Path

skills/android/android-security/SKILL.md

Commit

9f695e8

Last updated
First committed

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill