skills.rest
RavitejaKarra24
RavitejaKarra24COMMUNITY
Explore all skills by this author →
𝕏@RavitejaKarra24GitHub

android-intent-security

Hardens Android components against Intent redirection, PendingIntent hijacking, and unauthorized access.

Updated Mar 12, 2026
Search Tags:#security#audit#android#kotlin#intent redirection#pendingintent#contentprovider
One-click install
npx skills add https://github.com/RavitejaKarra24/dotfiles --skill android-intent-security-ravitejakarra24
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: android-intent-security
Source: https://github.com/RavitejaKarra24/dotfiles/tree/main/pi/.pi/agent/skills/android-intent-security
Command: npx skills add https://github.com/RavitejaKarra24/dotfiles --skill android-intent-security-ravitejakarra24

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires androidx.core:core:1.9.0.

What problem does it solve? Android apps that handle incoming Intents, exported components, PendingIntents, and ContentProviders are exposed to Intent redirection, component hijacking, and privilege escalation vulnerabilities. This Skill provides concrete patterns and decision logic to audit and secure these inter-component communication surfaces. ## Core Features & Use Cases - Safe Intent Redirection: Validate nested Intents manually or with AndroidX IntentSanitizer before launching, blocking cross-app redirection and URI permission grant abuse. - PendingIntent and Component Hardening: Enforce FLAG_IMMUTABLE defaults, explicit target components, signature-level permissions, and correct android:exported configuration. - ContentProvider and Service Protection: Parameterize provider queries with strict projection maps and verify caller signatures at runtime using PackageManager certificate checks. - Use Case: While auditing an AndroidManifest.xml and Kotlin source, apply the Skill to convert a mutable PendingIntent to FLAG_IMMUTABLE, add IntentSanitizer allowlists to a nested Intent flow, and produce a structured security alignment report with diffs. ## Quick Start Audit my AndroidManifest.xml and Kotlin intent-handling code for Intent redirection and PendingIntent vulnerabilities, then apply the recommended fixes.

Frequently Asked Questions about android-intent-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent Intent redirection vulnerabilities in Android?▼

Validate any nested Intent before launching it: verify the target package matches your app, confirm the target component is exported, and strip URI permission grant flags. With AndroidX Core 1.9.0+, use IntentSanitizer with an explicit allowlist of components, actions, and extras.

Should I use FLAG_IMMUTABLE or FLAG_MUTABLE for PendingIntent?▼

Use PendingIntent.FLAG_IMMUTABLE by default for alarms and notifications so receivers cannot alter the Intent. Use FLAG_MUTABLE only when required, such as inline notification replies, and always set an explicit target component on the base Intent.

How do I secure an exported Android Service against untrusted callers?▼

Retrieve the calling UID with Binder.getCallingUid(), resolve it via PackageManager.getPackagesForUid(), and verify the caller's signing certificate with hasSigningCertificate. Perform this check inside each Binder transaction method, not in onBind, since binder connections are cached.

Does IntentSanitizer work on older Android versions?▼

IntentSanitizer requires AndroidX Core 1.9.0 or higher and works at the library level, but the Skill targets a minimum of API 23. On projects without AndroidX Core 1.9.0+, fall back to manual validation of the nested Intent's package, exported status, and URI grant flags.

Why is checking callers in BroadcastReceiver.onReceive with getCallingUid unreliable?▼

Binder.getCallingUid inside onReceive returns the receiver's own UID, not the sender's, so it cannot identify broadcast senders. Instead rely on Protected Broadcasts for system events and protect custom receivers with signature-level permissions or RECEIVER_NOT_EXPORTED.

What are the limitations of this Android Intent security approach?▼

The guidance covers only local inter-component and inter-app communication security on the Android platform. It does not address network security, web integration, or host-to-server communication, which require separate controls such as TLS configuration and network security policies.

Related Skills

Explore More Software Engineering Skills→
tvh25082004tvh25082004

android-intent-security

Hardens Android components against Intent redirection and unauthorized access vulnerabilities.

Community
Advanced
SensLiaoSensLiao

security-remediation

Automate security finding remediation with regression tests and evidence generation.

Community
Advanced
Yenn503Yenn503
1

performing-android-app-static-analysis-with-mobsf

Performs static security analysis of Android APK files using the MobSF REST API.

Community
Intermediate
22Teikk22Teikk

security-and-hardening

Implements secure storage, network, and IPC hardening patterns for Android and Flutter applications.

Community
Intermediate