skills.rest
IsKenKenYa
IsKenKenYaCOMMUNITY
Explore all skills by this author →
GitHub

android-intent-security

Hardens Android components and Intent handling against redirection and unauthorized access.

2|Updated Jun 21, 2026
Search Tags:#security#android#signature verification#intent redirection#manifest audit#pendingintent#contentprovider
One-click install
npx skills add https://github.com/IsKenKenYa/skills --skill android-intent-security-iskenkenya
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: android-intent-security
Source: https://github.com/IsKenKenYa/skills/tree/main/skills/android/security/android-intent-security
Command: npx skills add https://github.com/IsKenKenYa/skills --skill android-intent-security-iskenkenya

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires androidx.core:core:1.9.0.

What problem does it solve? Android apps that expose Activities, Services, Receivers, or ContentProviders are vulnerable to Intent redirection, component hijacking, and privilege escalation when incoming Intents and PendingIntents are handled without validation. This Skill provides concrete patterns to audit manifests and secure inter-component communication. ## Core Features & Use Cases - Safe Intent Redirection: Validate nested Intents manually or with AndroidX IntentSanitizer before launching, blocking cross-app redirection and URI permission abuse. - Component Hardening: Configure exported flags, signature-level permissions, secure PendingIntent mutability, and parameterized ContentProvider queries. - Caller Verification: Verify calling app signatures in bound Services using Binder.getCallingUid and PackageManager certificate checks. - Use Case: While auditing an app's AndroidManifest.xml, you find an exported Activity that forwards a nested Intent. Use this Skill to replace the unsafe launch with an IntentSanitizer allowlist and generate a structured security alignment report. ## Quick Start Audit my AndroidManifest.xml and Intent handling code for Intent redirection vulnerabilities and apply the recommended security fixes.

Frequently Asked Questions about android-intent-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent Intent redirection vulnerabilities in Android?▼

Validate any nested Intent before launching it: check for URI permission grant flags, verify the target package matches your app, and confirm the target component is exported. With AndroidX Core 1.9.0+, use IntentSanitizer with an explicit allowlist of components, actions, and extras.

Should I use FLAG_IMMUTABLE or FLAG_MUTABLE for PendingIntent?▼

Use PendingIntent.FLAG_IMMUTABLE by default for alarms and notifications so receivers cannot alter the Intent. Use FLAG_MUTABLE only for cases like inline notification replies, and always set an explicit target component on the base Intent to prevent hijacking.

How do I secure an exported Android Service from untrusted callers?▼

Retrieve the caller UID with Binder.getCallingUid(), resolve it via PackageManager.getPackagesForUid(), and verify the package signature with hasSigningCertificate. Perform this check inside each Binder transaction method, not in onBind, since Android caches binder connections.

Does IntentSanitizer work on older Android versions?▼

IntentSanitizer requires AndroidX Core 1.9.0 or higher and works at the library level, so it is not tied to a specific Android OS version. Without it, you must manually verify the nested Intent's target package and exported status before launching.

What are the limitations of this Android Intent security guidance?▼

It covers only local inter-component and inter-app communication security on the Android platform. It does not address network security, web integration, or host-to-server security, which require separate hardening approaches.

Related Skills

Explore More Software Engineering Skills→
citytexicitytexi
1

android-intent-security

Audit and harden Android components against Intent redirection and unauthorized access.

Community
Advanced
Mithrandir21Mithrandir21

security-hardener

Audits Android apps against OWASP MASVS categories and produces risk-ranked remediation reports.

Community
Advanced
wgpsecwgpsec
45

AWS Security Hardening

Enforces AWS security best practices for IAM, networking, and data protection.

Official
Advanced
thinhtt264thinhtt264

android-viewmodel

Manage Android UI state with ViewModel, StateFlow, and SharedFlow.

Community
Basic