What problem does it solve? Mobile apps run in a hostile client environment where attackers can decompile binaries, read local storage, intercept network traffic, and inject malicious inputs through intents or deep links. This Skill provides concrete secure-coding patterns and checklists so Android and Flutter developers avoid common vulnerabilities like plaintext token storage, exported components, disabled TLS validation, and leaked secrets. ## Core Features & Use Cases - Secure Local Storage: Patterns for EncryptedSharedPreferences, SQLCipher-encrypted Room databases, and flutter_secure_storage instead of plaintext SharedPreferences. - Network & IPC Hardening: Network Security Config with certificate pinning, cleartext restrictions, exported-component rules, immutable PendingIntents, and WebView lockdown settings. - LLM Feature Security: OWASP LLM Top 10 guidance for apps calling language models, treating model output as untrusted input. - Use Case: Before releasing a banking app, run the security review checklist to verify exported attributes, R8 obfuscation, certificate pinning, and that no secrets ship via --dart-define or hardcoded Gradle files. ## Quick Start Review my Android manifest and storage code for security vulnerabilities and apply the hardening patterns from this skill.
