Android Security Standards
SkillFiles & storageSecure Android data at rest and authentication secrets. Use for auth tokens, encrypted storage, and app-data isolation; defer WebView/Intent/FileProvider to android-legacy-security and TLS/certificate pinning to android-networking.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Android Security Standards skill
What this skill tells your AI
The instructions your AI receives, as published by hoangnguyen0403/agent-skills-standard in skills/android/android-security/SKILL.md and read by ahel’s review.
Priority: P0 (CRITICAL)
Implementation Guidelines
Data Storage
- Secrets: NEVER store API keys in code. Use
EncryptedSharedPreferencesfor sensitive local data (Tokens). - Keystore: Use Android Keystore System for cryptographic keys.
Network
- HTTPS: Enforce HTTPS via
network_security_config.xml(cleartextTrafficPermitted="false"). - Pinning: Consider Certificate Pinning for high-security apps.
Component Export
- Exported: Explicitly set
android:exported="false"for Activities/Receivers unless intended for external use.
Anti-Patterns
- No Sensitive Logs: Strip logs in Release builds.
- No Homebrew Root Detection: Use Play Integrity API instead.
- No Raw URL String Concatenation: Use
Uri.BuilderorHttpUrl(OkHttp) to prevent parameter injection.
References
- Setup Examples
- [common/common-security-standards] — shared OWASP baselines
- [android/android-legacy-security] — Intent, WebView, and FileProvider hardening
Signals
- GitHub stars
- 565
- Forks
- 163
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
android-security- Source
- github.com/hoangnguyen0403/agent-skills-standard