The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references official Google Firebase libraries (com.google.firebase:firebase-bom) via standard Gradle dependency management.
[SAFE]: Follows Android security best practices by declaring the FirebaseMessagingService with android:exported="false" in the manifest, which prevents other applications from interacting with the service.
[SAFE]: Correctlly uses PendingIntent.FLAG_IMMUTABLE in references/implementation.md, which is a critical security requirement for Android 12 and above to prevent intent redirection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data received via Firebase Cloud Messaging.
Ingestion points: The onMessageReceived function in references/implementation.md ingests RemoteMessage objects from external sources.
Boundary markers: None; the implementation directly accesses the message.data map.
Capability inventory: The skill restricts the use of this data to UI navigation (handling taps) and basic notification display; there are no calls to eval(), subprocesses, or file system writes.
Sanitization: The code uses specific key lookups (putExtra("type", data["type"])) rather than iterating through or executing arbitrary payload data.

android-notifications