# Android Strictmode Expert

> >

- **Type:** Skill
- **Install:** `agentstack add skill-josephsanjaya-skills-android-strictmode-expert`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [JosephSanjaya](https://agentstack.voostack.com/s/josephsanjaya)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [JosephSanjaya](https://github.com/JosephSanjaya)
- **Source:** https://github.com/JosephSanjaya/skills/tree/main/android-strictmode-expert

## Install

```sh
agentstack add skill-josephsanjaya-skills-android-strictmode-expert
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Android StrictMode Expert

## 1. Quick Decision Tree

```
What is target issue?
├── Block UI thread (dropped frames, ANR) ── ThreadPolicy (read references/thread_policy.md)
│   ├── SharedPreferences waitToFinish / commit ── Migrate to Jetpack DataStore
│   ├── WebView database initialization ───────── Wrap allowThreadDiskWrites / allowThreadDiskReads
│   └── DNS query or network TLS handshake ────── Dispatch background threads (Retrofit/Coroutines)
├── Memory/Security/Intent violations ────────── VmPolicy (read references/vm_policy.md)
│   ├── Unclosed SQLite Cursor or Closeable ────── Wrap in kotlin-stdlib .use block
│   ├── Application context used for layout ────── Use Activity / createWindowContext API
│   ├── Sharing raw file:// URI ───────────────── Use FileProvider + FLAG_GRANT_READ_URI_PERMISSION
│   └── Android 15 background activity blocked ── Use ActivityOptions background start modes
└── Whitelist / Custom penalties needed ───────── StrictPro library (read references/strictpro.md)
```

Use strict coding paradigms. Restrict main-thread blocking operations. Route all background operations through Kotlin Coroutines (Dispatchers.IO for I/O, Dispatchers.Default for CPU-bound tasks). Wrap unavoidable main thread I/O in allowThreadDiskReads / allowThreadDiskWrites.

---

## 2. Core Policies Reference Index

Read these detailed guides for code-level diagnostics and resolutions:

*   [thread_policy.md](file:///Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/references/thread_policy.md): Direct analysis of thread-level diagnostics (disk reads, disk writes, unbuffered I/O, network sockets, custom slow calls, resource mismatches).
*   [vm_policy.md](file:///Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/references/vm_policy.md): Direct analysis of VM-level diagnostics (closable resource leaks, activity context leaks, BroadcastReceiver/ServiceConnection leaks, incorrect display context, File URI exposure, unsafe intent launches, Direct Boot storage bounds, blocked background activity launches).
*   [strictpro.md](file:///Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/references/strictpro.md): Structure of the StrictPro library, whitelisting stack signatures, and customizing penalty executors.
*   [best_practices.md](file:///Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/references/best_practices.md): Setup templates, phased rollout protocol, remote observability telemetry, LeakCanary conflicts, and CI/CD automated test verification.

---

## 3. Essential Config Templates

### Scoped Thread I/O Bypass
```kotlin
val oldPolicy = StrictMode.allowThreadDiskReads()
try {
    // Unavoidable sub-millisecond configuration reads on startup
} finally {
    StrictMode.setThreadPolicy(oldPolicy)
}
```

### StrictPro Setup DSL
```kotlin
class MainApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        if (BuildConfig.DEBUG) {
            StrictPro.listenActivities(this)
            StrictPro.setThreadPolicy(
                StrictPro.ThreadPolicy.Builder()
                    .detectAll()
                    .penaltyLog()
                    .penaltyDeath() // Crash on UI thread I/O
                    .setWhiteList {
                        contains("android.webkit.WebViewDatabase", null) // ignore WebView database load
                    }
                    .build()
            )
            StrictPro.setVmPolicy(
                StrictPro.VmPolicy.Builder()
                    .detectAll()
                    .penaltyLog() // Log only (prevent GC non-deterministic crashes)
                    .build()
            )
        }
    }
}
```

---

## 4. Operational Scanner Script

Automated Python script [scan_strictmode_violations.py](file:///Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/scripts/scan_strictmode_violations.py) scans directories recursively to flag common violations (e.g. `.commit()`, unbuffered I/O, `file://` intents, raw socket requests).

Run audit check:
```bash
python3 /Users/jsanjaya/.gemini/config/skills/android-strictmode-expert/scripts/scan_strictmode_violations.py 
```

---

## 5. Key Safeguards

> [!IMPORTANT]
> **Phased Rollout Rule:**
> - Phase 1: Enable log-only `.penaltyLog()` process-wide to record all issues in `strictmode.md`.
> - Phase 2: Upgrade ThreadPolicy to `.penaltyDeath()` for deterministic developer loop. Keep VmPolicy at `.penaltyLog()` to avoid non-deterministic process termination during GC sweeps.

> [!WARNING]
> **LeakCanary False Positives:**
> - Android `StrictMode` static fields retain the last seen Activity. Exclude `android.os.StrictMode` in LeakCanary `referenceMatchers` configuration to prevent false memory leak reports.

MUST maintain compatibility with targetSdk 35 (Android 15) guidelines.
MUST avoid cleartext network payloads.
MUST expose files strictly via FileProvider content:// URIs.
Format all Android code output as clean Kotlin or Java with explicit lifecycle and dispatcher mappings.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [JosephSanjaya](https://github.com/JosephSanjaya)
- **Source:** [JosephSanjaya/skills](https://github.com/JosephSanjaya/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-josephsanjaya-skills-android-strictmode-expert
- Seller: https://agentstack.voostack.com/s/josephsanjaya
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.