Skill: Android Security

• Use for manifest permissions, exported components, deep links, WebView, network security config, storage of secrets, and backup exposure.
• Apply least privilege and validate all exported surfaces.
• Treat cleartext traffic, auth token storage, and implicit intents as security review points.
• Verify with manifest merge/build tasks and targeted runtime checks when behavior changed.
• Explicitly mention policy or attack-surface risks if verification is incomplete.