kotlin-android-security-privacy

name	kotlin-android-security-privacy
description	Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.
allowed-tools	Read Grep Glob
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-07-21","category":"security","lifecycle":"experimental"}

kotlin-android-security-privacy

Purpose

This skill decides whether an Android app's security and privacy posture is safe to ship. A posture is safe only when exported surfaces are intentional and permission-gated, deep links are verified and validated, WebViews cannot execute untrusted script or reach the sandbox, traffic is not cleartext, secrets are Keystore-backed, backup excludes sensitive data, permissions are minimized, and PII never reaches logs. Every finding is mapped to a MASVS category.

Trigger conditions

• A user provides an AndroidManifest.xml, WebView setup, network-security-config, storage code, or permission declarations and asks whether the app is safely configured.
• A user is triaging a suspected component-exposure, deep-link-hijack, WebView, or data-leak issue.
• A user wants a MASVS-aligned review of an Android app's security and privacy posture.

When not to use

• The concern is a server-side/backend vulnerability — route to the application-security / Java security board.
• The concern is Android runtime performance, ANR, or memory — route to kotlin-android-performance-reliability-agent.
• The concern is Android architecture/lifecycle correctness — route to kotlin-android-architecture-agent.
• The concern is kotlinx.serialization polymorphism or wire-contract safety — route to kotlin-serialization-wire-contract-agent.
• The task requires running or instrumenting the app on a device — this skill is static-review only and flags such claims as needing on-device verification.

Lean operating rules

• CRITICAL — an activity/service/receiver/provider that is exported (explicitly android:exported="true", or implicitly by declaring an intent-filter) and reachable without a signature-level permission is an attack surface; require an explicit exported value (mandatory on API 31+), and require a permission or explicit-intent restriction for any component that performs a sensitive action.
• CRITICAL — addJavascriptInterface is reachable from every frame including iframes and has no origin-based access control; treat it as a critical defect for any WebView that can load untrusted or remote content, and require it be removed or scoped to fully trusted, first-party content only.
• CRITICAL — a WebView with setJavaScriptEnabled(true) combined with allowFileAccessFromFileURLs/allowUniversalAccessFromFileURLs or loading attacker-influenced URLs can exfiltrate the app sandbox; require file access disabled and URLs validated against an allowlist.
• HIGH — cleartext traffic: the default cleartextTrafficPermitted value is governed by the app's targetSdkVersion, not the device's OS version — an app targeting API 28+ defaults cleartext off, but an app targeting API 27 or lower still defaults cleartext on even when it runs on a newer device; require inspecting targetSdkVersion before treating the absence of a permissive network_security_config.xml/manifest entry as evidence cleartext is disabled (otherwise it is a false negative), and require cleartext be off except for a justified, scoped domain via a permissive network_security_config.xml, usesCleartextTraffic="true", or a broad <domain-config cleartextTrafficPermitted="true">.
• HIGH — a deep link or App Link that is not verified (android:autoVerify="true" with a matching Digital Asset Links file) can be claimed by another app; require App Links verification for any link that carries authentication tokens or triggers a sensitive action, and require the URI/parameters be validated before use.
• HIGH — sensitive data (tokens, credentials, PII) in plaintext SharedPreferences, an unencrypted file, or an external-storage location is a storage defect; require a current Android Keystore-backed storage design appropriate to the threat model rather than mandating EncryptedSharedPreferences — the AndroidX Security Crypto library (and EncryptedSharedPreferences) is deprecated as of Security Crypto 1.1.0 — and never a hard-coded key.
• HIGH — an implicit PendingIntent (no explicit component/package) or a mutable on API 31+ without where mutability is not required can be hijacked or tampered; require explicit target and unless mutation is justified.

References

Load these only when needed:

• Component Exposure And Intents
• Network, WebView, And Storage
• MASVS Mapping
• Official Sources
• Safety Checklist

Response minimum

• A verdict (pass / pass-with-conditions / block) and the app's trust assumption.
• Findings grouped by component exposure, deep links, WebView, network, storage/secrets/backup, and permissions/logging — each mapped to a MASVS category.
• A severity-labelled finding list, each with an evidence-basis label, and safe next actions plus any exposure needing on-device verification.