skills.rest
android
androidOFFICIAL
Explore all skills by this author →
Website𝕏@AndroidDevGitHub

android-permissions-security

Audits AndroidManifest.xml files to detect permission gaps and enforces secure Binder IPC calls using UID checks.

9.3k|601|Updated Mar 16, 2026
Search Tags:#security#permissions#manifest#android#ipc#runtime-permissions#binder
Ready to run
npx skills add https://github.com/android/skills --skill android-permissions-security-android
💬 Prompt for ChatGPT / Claude Chat▼
Please help me install this Agent Skill.
Skill: android-permissions-security
Source: https://github.com/android/skills/tree/main/security/android-permissions-security
Command: npx skills add https://github.com/android/skills --skill android-permissions-security-android

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Android apps often expose components without proper permission checks, leading to unauthorized access and security vulnerabilities in IPC. ## Core Features & Use Cases - Audits custom permissions and protection levels - Secures exported components and URI permissions - Implements cryptographic caller identity verification - Handles runtime permission flows safely - Uses Photo Picker for media selection Use case: Review an app's manifest and fix permission issues to prevent spoofing. ## Quick Start Review the AndroidManifest.xml file for permission declarations and run the audit playbook to identify gaps.

Frequently Asked Questions about android-permissions-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit custom permissions in an Android app?▼

Use the security audit playbook to inspect AndroidManifest.xml for protection levels and upgrade weak permissions to signature or knownSigner.

What is the correct protection level for restricting access to partner apps?▼

Use signature|knownSigner with android:knownCerts for API 31+ to grant access only to trusted certificate digests.

How to prevent caller spoofing in bound services?▼

Remove intent extra checks and use Binder.getCallingUid() combined with PackageManager.hasSigningCertificate() for verification.

Why should you never use checkCallingOrSelfPermission in services?▼

It falls back to host app permissions causing Confused Deputy vulnerability; use enforceCallingPermission instead.

How to request runtime permissions safely?▼

Implement a 3-state flow checking grant, rationale, and handling permanent denial by directing to Settings.ACTION_APPLICATION_DETAILS_SETTINGS.

What is the difference between normal and signature protection levels?▼

Normal permissions are low-risk and auto-granted; signature permissions restrict access to apps signed with the same certificate.

Related Skills

Explore More Software Engineering Skills→
yash-gargyash-garg

android-intent-security

Audit AndroidManifest.xml and incoming Intent handling for security vulnerabilities.

Community
Advanced
AlteriomAlteriom

Next.js

Build Next.js apps with App Router, server components, and caching.

Official
Advanced
GeargrindadminGeargrindadmin

lint-and-validate

Run ESLint, Ruff, MyPy, and npm audit to validate code.

Community
Intermediate
florianbuetowflorianbuetow
12

misconfig

Detects security misconfigurations in application and infrastructure files using scanners and Grep fallback.

Community
Advanced