Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add krutikJain/android-agent-skills --skill android-security-best-practicesgit clone --depth 1 https://github.com/krutikJain/android-agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/krutikjain/android-agent-skills/android-security-best-practices)<a href="https://agentmods.dev/skills/krutikjain/android-agent-skills/android-security-best-practices"><img src="https://agentmods.dev/badge/skills/krutikjain/android-agent-skills/android-security-best-practices/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/krutikjain/android-agent-skills/android-security-best-practices"><img src="https://agentmods.dev/badge/skills/krutikjain/android-agent-skills/android-security-best-practices.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01172 |
| Opus 5 | $0.00014 | $0.00586 |
| Sonnet 5 | $0.00005 | $0.00234 |
| Haiku 4.5 | $0.00003 | $0.00117 |
Grade A, and why
android-security-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android Security Best Practices
When To Use
- Use this skill when the request is about: android security review, secret handling android app, exported component security android.
- Primary outcome: Apply Android app security guidance around secrets, storage, network trust, exported components, and least privilege.
- Read
references/patterns.mdwhen you need the attack-surface checklist or the storage/network/component decision matrix. - Read
references/scenarios.mdfor manifest, backup, WebView, and release-hardening review paths. - Handoff skills when the scope expands:
android-modernization-upgradeandroid-ci-cd-release-playstore
Workflow
- Inventory the attack surface first: exported components, intent/deep link entry points, file sharing, WebView usage, local storage, logs, backups, and network trust config.
- Remove avoidable risk before hardening details: prefer platform pickers and choosers, internal storage, server-issued short-lived tokens, and least-privilege permissions instead of shipping broad access or long-lived secrets.
- Lock the remaining boundaries explicitly with
android:exported, component permissions,FileProvider,networkSecurityConfig, debug-only trust anchors, and immutablePendingIntents. - Review sensitive surfaces that often regress in Android apps: WebView JavaScript bridges, backup/data extraction rules, cleartext exceptions, log redaction, and same-developer IPC assumptions.
- Validate the release posture with reproducible checks, then document residual risks and whether backend enforcement or Play Integrity is advisory or blocking.
Guardrails
- Treat client-side secrets as recoverable by attackers; move trust decisions and privileged API access server-side whenever possible.
- Export components only when there is a real external caller, and permission-protect or signature-protect them when the contract is private.
- Use network security config to scope debug trust anchors or cleartext exceptions instead of broad manifest toggles.
- Redact logs, review backups, and keep sensitive data out of shared external storage by default.
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 78 lines · 27 tokens per session scan A 954c494401e6
android-security-best-practices is a skill published in the GitHub repository krutikJain/android-agent-skills (14 stars, last pushed 5mo ago), licensed MIT. It adds 27 tokens to every session and 1,172 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
navigate
Call the unintent tool with the following exact parameters.
compose-kotlin-agent-skills
Enterprise Android/Kotlin skill for 2026 — Kotlin 2.x K2 compiler, AGP 9, Navigation 3, edge-to-edge Compose, strict MVI with atomic state.update, banned AI antipatterns. Jetpack Compose, Hilt, Room, KMP, CameraX/ML Kit, performance, testing. Use when writing Kotlin for Android, building Compose UI, MVVM/MVI…
android-kotlin-compose
Jetpack Compose UI engineering for 2026 — edge-to-edge, Material 3, recomposition stability, Modifier ordering, LazyColumn performance, and animations. Use when building composables, fixing jank, theming, adaptive layouts, Canvas drawing, auditing screens, or asking "why does my screen recompose", "Modifier order"…
android-kotlin-architecture
Enforces Clean Architecture, MVVM/MVI, and unidirectional data flow for Android apps. Covers UiState, UiEvent, UiEffect, UseCase boundaries, module structure, and atomic ViewModel state via state.update. Use when structuring features, refactoring ViewModels, splitting modules, or asking "MVVM vs MVI", "where does…
android
Senior-level Android engineering expertise for Jetpack Compose, Material 3, shared element transitions, navigation, performance, security, background work, notifications, adaptive layouts, Coil image loading, WorkManager, FCM, Baseline Profiles, R8 optimization, accessibility, coroutines and Flow, and extraordinary UI…
compose-expert
Compose and Compose Multiplatform expert for UI development across Android, Desktop, iOS, and Web. Use whenever the user mentions Compose APIs (@Composable, remember, LaunchedEffect, NavHost, MaterialTheme, LazyColumn, Modifier, recomposition), Compose Multiplatform (commonMain, expect/actual, Res.…