# Android Security

> Android security engineering skill for threat-aware recommendations on secrets handling, secure storage, network hardening, Play Integrity, and release safeguards. Use this whenever security posture or sensitive data handling is in scope.

- **Type:** Skill
- **Install:** `agentstack add skill-adrigm06-android-engineering-skill-android-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [adrigm06](https://agentstack.voostack.com/s/adrigm06)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [adrigm06](https://github.com/adrigm06)
- **Source:** https://github.com/adrigm06/Android-Engineering-Skill/tree/master/skills/android-security

## Install

```sh
agentstack add skill-adrigm06-android-engineering-skill-android-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Purpose

Provide threat-aware Android security recommendations that reduce exploitability risk while remaining operationally feasible.

## Scope and authority

This skill has global critical override authority for:

- exploitable security risk
- sensitive data exposure pathways
- secrets and trust-boundary handling

If security risk is critical, this skill can override convenience, performance, or UX preferences.

## When to use

- credentials/tokens/PII handling
- secure storage and network hardening decisions
- integrity/tamper-risk mitigation planning
- security assessment of architecture/build/release changes

## Decision engine workflow

1. Identify assets, trust boundaries, and attacker capabilities.
2. Rank threats by exploitability and business impact.
3. Choose mitigations by risk reduction vs operational cost.
4. Define rollout controls and residual risk.
5. Align with release constraints and incident readiness.

## Branching decision tree

### Branch A: risk class

- `Critical exploitability`:
  - block release-impacting exposure
  - enforce immediate mitigation path
- `High but non-blocking`:
  - prioritize near-term remediation with guardrails
- `Medium/Low`:
  - schedule hardening with explicit risk acceptance notes

### Branch B: mitigation feasibility

- if ideal control is operationally heavy:
  - recommend staged mitigation plan with interim control
- if threat model is weak/unknown:
  - choose conservative baseline controls and request missing threat inputs

## Quantitative gates

Use measurable risk gates and label each `pass | at-risk | fail`:

- unresolved critical exploitability gate (must pass for release)
- sensitive data exposure gate (must pass for release)
- control coverage gate (critical assets mapped to active controls)
- observability gate (security-relevant detection/alert paths in place)

If threat evidence is incomplete, return a measurement and threat-model completion plan first.

## Tradeoff realism

Allow constrained compromises only when explicit:

- interim controls are acceptable if expiry criteria is defined
- partial hardening is acceptable when release windows are tight and residual risk is transparent

Do not frame risk acceptance as risk elimination.

## Uncertainty protocol

Always report confidence:

- `High` (>= 0.80)
- `Medium` (0.60-0.79)
- `Low` (< 0.60)

If confidence is medium/low:

- list assumptions and missing threat intel
- provide least-risk interim control
- escalate to `android-release-engineering` when residual risk may block release
- escalate to `android-architecture` when control requires structural change

## Cross-skill handoff payload

Use the standard payload defined in `../../AGENTS.md` (section: Cross-skill handoff contract).
Set `requesting_skill` to `android-security`.

## Output contract

Follow global order from `../../AGENTS.md`:

1. `Context and constraints`
2. `Decision and rationale`
3. `Alternatives considered`
4. `Tradeoffs`
5. `Risks and mitigations`
6. `Confidence and unknowns`
7. `Cross-skill impacts`
8. `Next implementation steps`

Also include:

- `Risk summary`
- `Threat surfaces`
- `Mitigation plan`
- `Storage/network/integrity controls`
- `Residual risks`
- `Implementation priorities`

## Anti-pattern detection

- secrets in source, resources, or build scripts
- plaintext sensitive data persistence
- custom crypto without strong justification
- UI-only security checks lacking backend enforcement
- security controls that are impractical to operate and therefore bypassed

## Related resources

- `references/mobile-threat-model.md`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [adrigm06](https://github.com/adrigm06)
- **Source:** [adrigm06/Android-Engineering-Skill](https://github.com/adrigm06/Android-Engineering-Skill)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-adrigm06-android-engineering-skill-android-security
- Seller: https://agentstack.voostack.com/s/adrigm06
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.