What problem does it solve? Android apps often accumulate unjustified permissions copied from templates or injected by libraries, which breaks permission-free alternatives, triggers Play Store restrictions, and erodes user trust. This Skill derives the exact permission set an app genuinely needs, forward from user-visible features, and keeps the manifest, runtime flow, ledger, and tests consistent. ## Core Features & Use Cases - Forward derivation with an alternatives gate: Each permission must trace from a named user feature through a concrete API call, and is rejected when a documented permission-free path (photo picker, ACTION_IMAGE_CAPTURE, SAF) serves the feature. - Three operations: derive (decide and record a ledger row), audit (read-only severity-classified report of the existing manifest set), and apply (write declarations, runtime request flows, and degradation paths). - Merged-manifest verification and testing: Reads the merged manifest and built APK via apkanalyzer, removes library-injected permissions with tools:node="remove", and covers granted, denied, and permanently denied states through ADB-driven tests. - Use Case: A dependency bump silently adds ACCESS_FINE_LOCATION to your app. Run the audit operation to get a Critical finding naming the library, then derive and apply to remove it with a recorded ledger row. ## Quick Start Ask the assistant to derive which Android permissions your app needs for a specific feature, or to audit the current manifest permission set for unjustified entries.
