Skip to content
Get packs

Android Intent Security Auditor

Audits Android manifests and code for insecure Intent handling and PendingIntent misuse.

Source Download skill
Repository
android/skills
Stars
10,278
Licence
Apache-2.0
Files
1 file

What it does

When installed, the agent follows Google's written guidelines for finding and fixing security holes in Android apps related to Intents, which are messages apps send to launch screens, services, or broadcasts. It checks AndroidManifest.xml component settings (such as exported activities, services, receivers, and providers), reviews code that reads incoming Intents, and recommends safer patterns like IntentSanitizer and immutable PendingIntents. The skill is a guidance document; it does not itself scan or change any project.

Great for

  • Android developers reviewing their app's manifest and components before release
  • Security reviewers auditing an Android codebase for Intent redirection risks
  • Teams migrating away from deprecated LocalBroadcastManager or mutable PendingIntents

Skip it if

  • Network, web, or server-side security, which the skill explicitly says it does not cover
  • Non-Android projects, since it only addresses the Android platform
  • Treating its output as a complete security audit: it gives patterns and rules, so a human should still verify the actual code

Try asking

  • “Audit my AndroidManifest.xml for exported activities and services that could be abused by other apps.”
  • “Check this Activity's getIntent and getParcelableExtra code for Intent redirection vulnerabilities.”
  • “Review how my app creates PendingIntents for notifications and tell me if any should be immutable.”
  • “Explain how to use IntentSanitizer to safely forward a nested Intent.”
Step-by-step guide: how to use Android Intent Security AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    android-intent-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip android-intent-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip android-intent-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the agent at specific files, such as AndroidManifest.xml and the Activity or Service classes, so it can apply the rules to real code.
  • Ask it to explain each finding with the rule it relies on, then verify the fixes by testing on a device or emulator.
  • Make sure your project uses AndroidX Core 1.9.0 or later if you want to use the IntentSanitizer approach.

What's inside

  • SKILL.md

Redistributed unmodified from android/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.