handler.proceed() in onReceivedSslError, added once for a staging server, or addJavascriptInterface on a WebView that opens any URL from a deep link: the first lets anyone on the same Wi-Fi read your users' traffic, the second lets any web page call your app's code. This skill finds those and nine other Android code mistakes before you ship, and tells you how to fix each one.

Your agent runs a scanner on your app's .kt and .java files and the string resources in res/values. It reads Kotlin and Java as code (comments, raw strings, $templates), skips tests, generated code and build folders, and knows the usual guards: if (BuildConfig.DEBUG), debug source sets, a shouldOverrideUrlLoading allow list, ? placeholders in SQL, FLAG_IMMUTABLE set in a local variable. Keys meant to ship in apps, such as Google Maps and Firebase keys, are not reported. It never runs Gradle or the app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: a WebView JavaScript bridge (addJavascriptInterface) on a page loaded from the web or from an Intent, with no navigation allow list

• A02: onReceivedSslError that calls proceed(), trust-all TrustManagers, and hostname verifiers that accept any host

• A03: secrets in code or string resources: known key formats, Supabase service_role keys, fixed Authorization and X-Api-Key headers, Gemini keys, long values under secret names

REVIEW (check before release)

• A11: tokens and passwords saved in plain SharedPreferences or Preferences DataStore

• A12: tokens, passwords and session ids in Log, Timber or println output, and HttpLoggingInterceptor logging bodies or unredacted headers

• A13: MODE_WORLD_READABLE, setReadable(true, false) and chmod 666 or 777

• A14: PendingIntents without FLAG_IMMUTABLE, or FLAG_MUTABLE around an implicit Intent

• A15: http:// and ws:// servers in code and string resources, and WebView mixed content

• A16: WebView file access (allowFileAccess and the file-URL access settings)

• A17: SQL for rawQuery, execSQL or SimpleSQLiteQuery built from text values with templates or + (typed numbers are fine)

• A18: WebView debugging turned on outside debug builds

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example Android project, and the real report the scanner produces on the risky one

Limits

It reads each file as written: values that pass between files, Gradle buildConfigField values, AndroidManifest.xml, native code and your dependencies are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 25 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (16 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.