skills.rest
citytexi
citytexiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

android-intent-security

Audit and harden Android components against Intent redirection and unauthorized access.

1|Updated Jul 6, 2026
Search Tags:#security#audit#android#kotlin#intent redirection#pendingintent#contentprovider
One-click install
npx skills add https://github.com/citytexi/team-yg-pesonal-agent --skill android-intent-security-citytexi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: android-intent-security
Source: https://github.com/citytexi/team-yg-pesonal-agent/tree/main/.claude/skills/android-intent-security
Command: npx skills add https://github.com/citytexi/team-yg-pesonal-agent --skill android-intent-security-citytexi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires androidx.core:core:1.9.0.

What problem does it solve? Android apps that receive Intents from untrusted sources are vulnerable to Intent redirection, component hijacking, and privilege escalation. This Skill provides concrete patterns to audit AndroidManifest.xml configurations and secure Activities, Services, Broadcast Receivers, and Content Providers. ## Core Features & Use Cases - Safe Intent Redirection: Validate nested Intents manually or with AndroidX IntentSanitizer before launching, blocking cross-app redirection and URI permission abuse. - PendingIntent Hardening: Enforce FLAG_IMMUTABLE by default and require explicit target components for mutable PendingIntents. - Component Protection: Apply signature-level permissions, exported flags, and runtime caller signature verification for Services and ContentProviders. - Use Case: While reviewing an Android app, you find an exported Activity that launches a nested Intent from an extra. Use this Skill to replace the unsafe launch with an IntentSanitizer allowlist and generate a structured security alignment report. ## Quick Start Audit my AndroidManifest.xml and the Intent handling code in this project for Intent redirection vulnerabilities and apply the recommended fixes.

Frequently Asked Questions about android-intent-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent Intent redirection in Android?▼

Validate any nested Intent before launching it: verify the target package matches your app, confirm the target component is exported, and strip URI permission grant flags. With AndroidX Core 1.9.0+, use IntentSanitizer with an explicit allowlist of components, actions, and extras.

Should I use FLAG_IMMUTABLE or FLAG_MUTABLE for PendingIntent?▼

Use PendingIntent.FLAG_IMMUTABLE by default for alarms and notifications. Use FLAG_MUTABLE only when required, such as inline notification replies, and always set an explicit target component on the base Intent to prevent hijacking.

How do I verify the calling app of an Android Service?▼

Retrieve the caller UID with Binder.getCallingUid(), resolve it to package names via PackageManager.getPackagesForUid(), then verify the signing certificate with PackageManager.hasSigningCertificate(). Perform this check inside each Binder transaction method, not in onBind().

Does IntentSanitizer work on older Android versions?▼

IntentSanitizer requires AndroidX Core 1.9.0 or higher and works at the library level, but the skill targets a minimum of API 23. On projects without AndroidX Core 1.9.0+, fall back to manual validation of the nested Intent's package, exported status, and URI flags.

What are the limitations of this Android Intent security guidance?▼

It covers only local inter-component and inter-app communication security on the Android platform. It does not address network security, web integration, WebView hardening, or host-to-server communication.

Related Skills

Explore More Software Engineering Skills→
androidandroid
7.1k

android-intent-security

Hardens Android components against Intent redirection and unauthorized access vulnerabilities.

Official
Advanced
meridianhubmeridianhub
10

skill-security-practices

Automate security scanning with gosec, Trivy, and SBOM generation in CI/CD pipelines.

Official
Advanced
wgpsecwgpsec
1.7k

android-app-pentesting

Tests Android APK security through static analysis, Frida dynamic hooking, and component auditing.

Official
Advanced
aivos-xieaivos-xie
1

mobile-security

Analyze APK files for vulnerabilities using static and dynamic security analysis.

Community
Advanced