Guide · Agent skill
How to use the Android Intent Security Auditor agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The android-intent-security skill gives an AI agent Google's written guidance for finding and fixing Intent-related security problems in Android apps. It is aimed at Android developers preparing a release, security reviewers reading an Android codebase, and teams moving off deprecated or risky Intent patterns. After this guide you will know how to install the skill, ask for an audit in plain language, and read what the agent should check.
Android Intent Security Auditorandroid/skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the android-intent-security skill ZIP from this page. The skill folder contains a single file, SKILL.md.
- 2Unzip the skill. Unzip the file so the android-intent-security folder sits inside ~/.claude/skills/ for personal use, or inside .claude/skills/ of your project.
- 3Or upload it in the apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.
- 4Open your Android project. Start the agent in the Android project you want to review, so it can read AndroidManifest.xml and the source files.
- 5Ask for an audit. Make a plain request that names the component or file, such as checking exported activities in AndroidManifest.xml.
- 6Review each finding. Read the agent's reasoning against the skill's rules and confirm the issue in the code before you change anything.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file that gives an AI agent instructions for one kind of task. When the skill is installed and relevant, the agent reads these instructions and follows them while it works.
This skill covers Intents, which are messages Android apps send to launch activities, services or broadcasts. The agent follows the skill's rules to check AndroidManifest.xml component settings such as exported activities, services, receivers and providers. It also reviews code that reads incoming Intents and recommends safer patterns, such as IntentSanitizer for nested Intents and immutable PendingIntents by default.
- Checks exported and permission settings on components in AndroidManifest.xml
- Reviews source code that reads incoming Intents, for example through getIntent or getParcelableExtra
- Recommends IntentSanitizer, immutable PendingIntents and signature-level permissions where the skill's rules call for them
- Explains patterns for caller verification in exported services
Install the android-intent-security skill
You can install the skill for yourself or for a single project. Download the skill ZIP from this page and unzip it. Place the resulting folder in ~/.claude/skills/ to make it available across your projects, or in the .claude/skills/ folder of one project to make it available only there.
Alternatively, upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the .claude/skills/ folder of your project
- App install: upload the ZIP under Settings, then Capabilities, then Skills
Trigger the skill with natural requests
You do not need a special command. The skill's description tells the agent to use it when auditing component configurations in AndroidManifest.xml or source code that handles incoming Intents. Ask for that work directly and name the files or components you care about.
Specific requests work better than general ones. Say which component, which file and what you want checked.
- Audit the exported activities and services in my AndroidManifest.xml before release.
- Review how MainActivity handles the Intent it receives and check for Intent redirection.
- Check whether my PendingIntents for notifications should be immutable.
- Look at my ContentProvider declaration and tell me if it needs readPermission and writePermission.
- Check whether my nested Intent extra is validated before it launches a component.
What you need before you start
The skill expects an Android project. It states a minimum Android API level and requires the AndroidX Core library, at the version the skill specifies, for IntentSanitizer. Projects below the stated API level, or without that library, are handled by the manual validation path described in the skill.
The skill also expects the agent to use standard Android PackageManager APIs for runtime component checks. It does not run any scripts or use the network itself.
- An Android project with an AndroidManifest.xml file
- The AndroidX Core library at the version the skill specifies, if you want IntentSanitizer
- Standard Android PackageManager APIs available to the project
Safety notes: scripts and network
According to the listing, the skill runs no scripts and uses no network. It is a guidance document: it does not scan, modify or test your project on its own. The agent reads your code and applies the skill's rules, so any changes it proposes are ones you should review before committing.
The skill explicitly excludes network security, web integration and host-to-server security. Use it only for local inter-component and inter-app communication on Android.
- No scripts are run by the skill
- No network access is used by the skill
- The skill does not scan or change your project by itself
- Network, web and server-side security are out of scope
Tips for getting useful results
Treat the output as a checklist of patterns and rules, not a complete security audit. A person should still verify the actual code and test the behaviour of exported components.
Give the agent the manifest and the specific code that reads Intents together, so it can connect a component's export settings to the code that handles its input. If the project still uses LocalBroadcastManager or mutable PendingIntents, say so, because the skill treats both as items to review.
- Include both the manifest and the relevant Activity or Service source in one request
- Ask for the reason behind each recommendation so you can check it
- Confirm each finding in the code before changing it
- Re-run the audit after fixes to check the changes
<permission android:name="${applicationId}.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="signature" />What people use it for
- Reviewing exported activities, services, receivers and providers in AndroidManifest.xml before a release
- Checking an Activity that receives a nested Intent for Intent redirection risks
- Confirming that notification PendingIntents use FLAG_IMMUTABLE unless a mutable one is required
- Planning a migration away from the deprecated LocalBroadcastManager
- Checking that a custom ContentProvider is protected with read and write permissions
Frequently asked questions
Is the android-intent-security skill free?
The listing states the licence as Apache-2.0. The skill's SKILL.md points to complete terms in a LICENSE.txt file, so read that file for the full terms before reuse.
How do I install an agent skill like this one?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. You can also upload the ZIP in the Claude apps under Settings, then Capabilities, then Skills.
Does the skill scan my Android app automatically?
No. The skill is a guidance document. It runs no scripts and does not scan or change your project by itself. The agent applies its rules to the code and files you provide.
What do I need to use it?
You need an Android project with an AndroidManifest.xml file. The skill states a minimum Android API level, and it needs the AndroidX Core library at the version it specifies for IntentSanitizer.
Can I use it for web or server security?
No. The skill explicitly does not cover network security, web integration or host-to-server security. It only addresses Android local inter-component and inter-app communication.
Can I rely on it as a full security audit?
No. It gives patterns and rules for Intent security, so a human should still verify the actual code before release.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits Android developers and security reviewers who want an agent to apply Google's Intent security guidance to a manifest and to the code that reads incoming Intents. It is a poor fit for non-Android projects, network or server security, or anyone who needs an automated scanner that reports on its own. Use it as a structured checklist and keep a person in the loop to verify the findings.
Download the skill