android-security

Inspect Android manifest exports, permissions, and sensitive storage for attack surfaces.

16|Updated Apr 30, 2026

Search Tags:#security #permissions #manifest #android #security-review #webview

Ready to run

npx skills add https://github.com/JCE-Joshhh77/JCE-Opencode-Tools --skill android-security-jce-joshhh77

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: android-security
Source: https://github.com/JCE-Joshhh77/JCE-Opencode-Tools/tree/main/config/skills/android-security
Command: npx skills add https://github.com/JCE-Joshhh77/JCE-Opencode-Tools --skill android-security-jce-joshhh77

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Android apps often expose attack surfaces through manifest exports, permissions, deep links, and insecure storage of secrets. This skill provides a structured review to identify and mitigate these risky surfaces to reduce the risk of leakage or misuse.

Core Features & Use Cases

Manifest review: verify android:exported, intent-filters, and requested permissions to enforce least privilege.
Surface analysis: assess deep links, WebView usage, network security config, and backup exposure for potential attack vectors.
Guidance & remediation: provide concrete steps to remediate exposed surfaces and validate changes with build and runtime checks.

Quick Start

Review an Android app's manifest and security-sensitive components, then outline recommended mitigations.

Frequently Asked Questions about android-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review my Android manifest for security vulnerabilities?▼

To review an Android manifest for security vulnerabilities, inspect android:exported attributes, intent-filters, and requested permissions to enforce least privilege and prevent unauthorized component access.

What are common Android app attack surfaces I should check?▼

Common Android app attack surfaces include deep links, WebView configurations, cleartext traffic, insecure backup settings, and sensitive storage, which require inspection to prevent data leakage or misuse.

How do I secure WebView usage in my Android application?▼

Securing WebView usage requires assessing configurations for potential attack vectors, applying network security config, and enforcing targeted runtime checks to prevent unauthorized access to sensitive app surfaces.

How do I check for exposed components in an Android manifest merge?▼

Checking for exposed components in an Android manifest merge requires verifying final exported attributes and intent-filters across merged configurations to ensure no unintended surfaces are publicly accessible.

How do I prevent cleartext traffic and backup exposure in Android apps?▼

Preventing cleartext traffic and backup exposure involves reviewing network security configurations and privacy settings, then applying concrete remediation steps to block insecure traffic and protect sensitive data.