CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

android-security

Secure Android data at rest and authentication secrets. Use for auth tokens, encrypted storage, and app-data isolation; defer WebView/Intent/FileProvider to android-legacy-security and TLS/certificate pinning to android-networking.

68

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-structured standards skill: highly token-efficient, concrete API-level guidance, and clean one-level reference split. The main gap is workflow clarity — there is no sequencing or verification guidance, and an empty "Priority: P0 (CRITICAL)" header sits at the top with no content.

Suggestions

Remove or populate the dangling "## **Priority: P0 (CRITICAL)**" header — as written it adds no information and makes the document structure incoherent.

Add a brief verification step for applying the standards, e.g. a lint/audit command or a checklist like 'confirm no cleartextTrafficPermitted="true" and every exported component is intentional' so the guidance has an explicit completion checkpoint.

Make the soft directives concrete: replace "Strip logs in Release builds" with the mechanism (e.g. R8 `assumenosideeffects` rules for Log) and "Consider Certificate Pinning" with when pinning is warranted, since the XML example already exists in references/implementation.md.

DimensionReasoningScore

Conciseness

The body is a lean set of bullet directives ("NEVER store API keys in code", "Enforce HTTPS via `network_security_config.xml`") with zero padding and no explanation of concepts Claude already knows; every token earns its place.

5 / 5

Actionability

Most guidance names specific, executable APIs and attributes (`EncryptedSharedPreferences`, `cleartextTrafficPermitted="false"`, `android:exported="false"`, Play Integrity API, `Uri.Builder`) with runnable code in references/implementation.md, but a few items stay high-level ("Strip logs in Release builds" gives no mechanism; "Consider Certificate Pinning" is hedged), matching anchor 4 rather than fully copy-paste-ready 5.

4 / 5

Workflow Clarity

This is declarative standards guidance with no sequence or checkpoints at all — no ordered steps, no validation/verification step for applying the standards — and the dangling empty header "## **Priority: P0 (CRITICAL)**" adds incoherent structure, matching anchor 3; it is above anchor 2 because the per-category guidance itself is unambiguous.

3 / 5

Progressive Disclosure

The ~30-line body is well organized into sections and points to one clearly-signaled, one-level-deep reference ([Setup Examples](references/implementation.md)) that exists on disk and holds the bulk code examples; the other two pointers route to sibling skills rather than nested files.

5 / 5

Total

17

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: concrete scope, an explicit "Use for" trigger clause, and explicit boundary deferrals to sibling skills that sharply reduce conflict risk. The only weakness is moderate trigger-term coverage — a few natural synonyms (e.g., "API keys", "secure storage") appear only in metadata keywords, not the description.

DimensionReasoningScore

Specificity

"Secure Android data at rest and authentication secrets" names the domain and several concrete capability areas ("auth tokens, encrypted storage, app-data isolation"), but stops short of listing multiple specific actions, so it matches anchor 4 rather than 5.

4 / 5

Completeness

It explicitly answers both "what" ("Secure Android data at rest and authentication secrets") and "when" ("Use for auth tokens, encrypted storage, and app-data isolation") with concrete trigger phrases, matching the top anchor; it is not the level below because the 'when' clause is explicit rather than weakly implied.

5 / 5

Trigger Term Quality

"auth tokens" and "encrypted storage" are natural phrases users would say, and "app-data isolation" adds a relevant term, but common variations like "API keys", "keystore", or "secure storage" are absent from the description itself.

4 / 5

Distinctiveness Conflict Risk

The deferral clauses ("defer WebView/Intent/FileProvider to android-legacy-security and TLS/certificate pinning to android-networking") actively carve out a clear niche with minimal conflict risk, exceeding the "minor overlap risk" of anchor 4.

5 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

Total

14

/

16

Passed

Repository

HoangNguyen0403/agent-skills-standard

Path

skills/android/android-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.