AI agent skill · by @HoangNguyen0403

Android Legacy Security

Harden Intent handling, WebView configuration, and FileProvider access in Android apps. Use when securing Intent extras, configuring WebViews, or exposing files via FileProvider; defer manifest export flags and generic Bundle typing to focused Android security guidance.

Archived 2026-10-23 · Source updated 2026-09-15 · License: MIT. Check the original repository for the latest version.

SKILL.md instructions

# Android Legacy Security Standards

## **Priority: P0 (CRITICAL)**

## 1. Secure Intents and Components

- Set `android:exported="false"` for all internal Activities/Services unless needed for deep links.
- Verify `resolveActivity` before starting implicit intents.
- Treat all incoming Intent extras as untrusted — validate all schema/data types.

See [hardening examples](references/implementation.md) for manifest and component restrictions.

## 2. Lock Down WebViews

- Default to `javaScriptEnabled = false`. Use `WebViewClient` and `WebChromeClient` to restrict navigation.
- Disable `allowFileAccess` and `allowFileAccessFromFileURLs` to prevent local file theft via XSS.
- If using `@JavascriptInterface` (API 17+), strictly limit exposed API surface.

See [hardening examples](references/implementation.md) for WebView lockdown patterns.

## 3. Protect Storage and Files

- **NEVER expose `file://` URIs**. Use `FileProvider` to generate `content://` URIs with temporary permissions.
- Use `EncryptedSharedPreferences` for auth tokens and PII. Never use legacy public-read file modes.
- Use `NetworkSecurityConfig` to disable `cleartextTrafficPermitted` and implement certificate pinning.

## Anti-Patterns

- **No Implicit Intents Internally**: Use explicit intents with component class name.
- **No Public Read Modes**: Never expose SharedPreferences or files with global read access.

## References

- [Hardening Examples](references/implementation.md)