android-security-skill

name	android-security-skill
description	Comprehensive Android app security best practices from official Android documentation. Use when implementing features, reviewing security issues, handling sensitive data, or ensuring compliance with Android security guidelines.

Disclaimer

This AI skill is provided "as is", without warranty of any kind, express or implied.

The generated code may contain errors, security vulnerabilities, or unintended behavior. You are solely responsible for reviewing, testing, and validating any output before use.

The author assumes no liability for any damages arising from the use of this skill.

Intended Use

This skill is intended as an assistive tool for developers. It is not guaranteed to produce secure, production-ready, or legally compliant code.

Security Topics

Communication Security

Secure network communication, IPC, inter-app communication, and WebView security.

Key Topics:

• Network Security Configuration (HTTPS/TLS)
• WebView security best practices
• IPC mechanisms (Binder, Messenger, Services, Broadcast Receivers)

Data Storage

Secure data storage strategies for sensitive information.

Key Topics:

• Internal storage (most secure)
• External storage validation
• SharedPreferences security
• Cache file management
• Input validation

Authentication & Credentials

User authentication, biometrics, and credential management.

Key Topics:

• Credential Manager integration
• Passkeys and biometric authentication
• Account Manager usage
• Credential exposure minimization

Permissions

Permission best practices and minimization strategies.

Key Topics:

• Minimal permission requests
• Using intents instead of permissions
• Signature-based permissions
• Permission-protected data sharing

Cryptography

Cryptographic best practices and key management.

Key Topics:

• JCA security providers
• AES and Elliptic Curve algorithms
• Key generation and storage (Android Keystore)
• API key management
• Certificate pinning

Android Components Security

Security for Services, BroadcastReceivers, ContentProviders, and Activities.

Key Topics:

• Component export control
• Service security
• BroadcastReceiver permissions
• ContentProvider security
• Dynamic code loading risks

AI Security Risks

Security considerations for apps using generative AI and Large Language Models (LLMs).

Key Topics:

• Prompt injection
• Sensitive information disclosure
• Excessive agency

---

Official Documentation Links

Android Developers (developer.android.com)

• Security Best Practices
• Security Checklist
• Android Keystore System
• Network Security Configuration
• Cryptography Guide

Android Open Source Project (source.android.com)

• Security Best Practices
• App Security Best Practices
• System Security Best Practices
• Android Security Overview
• Monthly Security Bulletins