Skip to content
Get packs

Android Permissions Security Auditor

Audits Android app permissions and IPC component security, and guides fixes for gaps.

Source Download skill
Repository
android/skills
Stars
10,278
Licence
Apache-2.0
Files
5 files

What it does

Once installed, the agent knows Android's permission model and common security mistakes in app manifests, content providers, services, broadcasts and runtime permission prompts. When you ask it to review an Android project, it checks for weak custom permissions, overly broad file or URI access, spoofable caller identity checks, and poor permission request flows, then suggests specific fixes. It works from reference notes and guidance written into the skill, so its advice follows the documented Android approach.

Great for

  • Android developers reviewing AndroidManifest.xml before a release
  • Security reviewers checking exported components, providers and bound services
  • Teams migrating from broad storage permissions to the Photo Picker

Skip it if

  • Non-developers looking for a turnkey security scan: it gives guidance, not a verified audit, and can miss issues or misread code without human review
  • Non-Android projects (iOS, web backends), where the guidance does not apply

Try asking

  • “Review my AndroidManifest.xml for weak custom permissions and exported providers”
  • “Check whether my service verifies caller identity with Binder.getCallingUid()”
  • “Update my photo picker code to avoid READ_MEDIA_IMAGES”
  • “Fix my runtime permission flow so it handles denial and permanent denial”
Step-by-step guide: how to use Android Permissions Security AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the Apache-2.0 licence and an attribution note.

    android-permissions-security.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip android-permissions-security.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip android-permissions-security.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point the agent at specific files (AndroidManifest.xml, service and provider classes) rather than asking for a general review, for more precise findings.
  • Ask it to explain each finding's risk and verify fixes with your own tests, since it provides guidance rather than a guaranteed audit.
  • Specify your minSdk and targetSdk so it recommends APIs your app can actually use.

What's inside

  • references/android/guide/topics/manifest/permission-element.md
  • references/android/guide/topics/permissions/overview.md
  • references/android/privacy-and-security/risks/sender-of-pending-intents.md
  • references/android/training/permissions/requesting.md
  • SKILL.md

Redistributed unmodified from android/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.