Skip to content
Agentmart
Submit a tool

android-security

Security audit for Android projects.

Skill by FelixGraeber

IndexedMIT★ 3
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/felixgraeber-android-security

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Security audit for Android projects. Checks OWASP-oriented client-side risks, manifest exposure, hardcoded secrets, WebView handling, storage posture, and build obfuscation evidence. Triggers on: "security", "OWASP", "permissions", "encryption", "WebView", "certificate pinning".

Use cases: security

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/android-security

What's inside

Skill name
android-security
Description
Security audit for Android projects. Checks OWASP-oriented client-side risks, manifest exposure, hardcoded secrets, WebView handling, storage posture, and build obfuscation evidence. Triggers on: "security", "OWASP", "permissions", "encryption", "WebView", "certificate pinning".
License
MIT
Instructions
30 lines in SKILL.md · view on GitHub

Files (1)

  • SKILL.md

SKILL.md (first lines)

# Android Security Audit

## Scope

This skill scores only what can be defended from static Android project evidence.

It should separate:

- verified static findings
- likely risks from static evidence
- backend, operational, and runtime controls that require external evidence

## Storage Guidance

Use one repo-wide position:

- `androidx.security:security-crypto` is deprecated and should be treated as migration debt.
- Do not prescribe a single replacement for every app.
- Prefer threat-model-specific guidance:
  - consumer app: platform keystore + minimal secret storage
  - higher-risk app: keystore-backed key handling plus stronger architectural separation
  - SDK/library: avoid forcing storage strategy assumptions on host apps

## Avoid Overclaiming

- Play Integrity is contextual, not a universal maturity requirement.
- Certificate pinning is situational and must include operational tradeoffs.
- Static source review cannot prove server-side controls, incident response, or compliance posture.

From FelixGraeber/claude-android-audit-skill, MIT.

More from FelixGraeber/claude-android-audit-skill

Signals

Stars
3
Forks
0
Open issues
0
Last commit (this folder)
Jul 29, 2026 (3 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License
MIT
Repository
github.com/FelixGraeber/claude-android-audit-skill
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from FelixGraeber

Cite this page

android-security skill. Agent Mart. https://agentmart.dev/skills/felixgraeber-android-security (last updated 2026-10-24)