reis-mobile 0.3.6 → 0.4.0

package/skills/android-engage-sdk-integration/references/troubleshooting.md

@@ -0,0 +1,39 @@
+This guide helps resolve common compilation, import, and sandbox-related errors encountered during the Play Engage SDK integration.
+
+## 1. Ensure sandbox compilation safety for agents
+
+When executing compilations in sandboxed or ephemeral workspaces, such as evaluation environments or automated presubmits, you must follow these rules to prevent container crashes and lockups:
+
+- **Use full compilation** : Run `./gradlew compileDebugUnitTestSources --no-daemon` or `./gradlew assembleDebug --no-daemon`.
+- **Don't use compilation shortcuts** : Avoid commands like `./gradlew :app:compileDebugKotlin` or other compile-only tasks. These shortcuts bypass manifest merging and resource packaging, which can hide critical errors like namespace conflicts or XML syntax errors.
+- **Don't run full tests or builds** : Don't run `./gradlew test` or `./gradlew build`. These tasks trigger heavy testing environments (requiring emulators) and run full builds, which easily crash the FUSE filesystem mounts and exhaust sandbox CPU and RAM.
+- **Always use --no-daemon** : Always append `--no-daemon` to prevent background JVM processes from leaking and locking files in the sandbox.
+
+## 2. Resolve missing imports
+
+If you're upgrading the SDK version, for example, to 1.6.0, or if you get `Unresolved reference` errors during the initial compilation, make sure you've added the correct import statements:
+
+| Class name | Package or import statement | Note |
+|---|---|---|
+| `ImageTheme` | `import com.google.android.engage.common.datamodel.ImageTheme` |   |
+| `PlatformSpecificUri` | `import com.google.android.engage.common.datamodel.PlatformSpecificUri` |   |
+| `DisplayTimeWindow` | `import com.google.android.engage.common.datamodel.DisplayTimeWindow` |   |
+| `RatingSystem` | `import com.google.android.engage.video.datamodel.RatingSystem` | Note: It's under `video.datamodel`, not `common.datamodel`. |
+
+## 3. Resolve namespace conflicts
+
+You might receive an error message like this one:
+
+    Namespace 'com.google.android.engage' is used in multiple modules and/or libraries: com.google.android.engage:engage-core:1.6.0, com.google.android.engage:engage-tv:1.1.0
+
+This conflict occurs because both packages declare the same namespace.
+\* **Resolution** : Remove the explicit `engage-core` dependency from your `build.gradle` or `build.gradle.kts` and keep *only* `engage-tv`. The `engage-tv` library transitively pulls in the compatible version of `engage-core` automatically.
+
+## 4. Resolve sandbox-specific build and test failures
+
+When compiling or running tests in the evaluation sandbox (especially for large projects like Now in Android), you might encounter environment-specific failures:
+
+- **Jlink error with Android SDK 36** : If the build fails during Java compilation with a `jlink` error in `JdkImageTransform` for `android-36`, force Gradle to use JDK 17 by prepending `JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64` to the Gradle command.
+- **Missing ANDROID_HOME** : If lint or test tasks fail complaining about missing SDK, explicitly set the environment variable `ANDROID_HOME=/usr/local/google/home/shashvatgupta/Android/Sdk` (or the corresponding path on the workstation).
+- **Roborazzi screenshot mismatches** : Headless or sandbox container rendering might differ from local golden images, causing Roborazzi screenshot test assertions to fail. Bypass these visual checks by appending `-Proborazzi.test.verify=false` to your test command.
+- **Robolectric SDK 36 unsupported** : If screenshot tests fail with `java.lang.UnsupportedOperationException` in `DefaultSdkProvider` due to experimental SDK 36, update the `@Config` annotation in the failing test files to pin the SDK to 34 (e.g., `@Config(..., sdk = [34])`).

package/skills/android-gradle-build-debug/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: android-gradle-build-debug
+description: Diagnoses failing Android Gradle builds — JDK, Gradle, Android Gradle Plugin and Kotlin version mismatches, dependency resolution and duplicate classes, compileSdk and minSdk errors, manifest merger and namespace failures, kapt/KSP, R8 missing classes, signing and out-of-memory builds. Use whenever an Android, Kotlin Multiplatform, Flutter or React Native build fails in Gradle, when the log shows "What went wrong", "Execution failed for task" or "BUILD FAILED", or after upgrading AGP, Gradle, Kotlin or the JDK, even if the user only pastes the error.
+intents: [debug, build, dependency, migration]
+stacks: [android, kotlin-multiplatform]
+areas: [gradle, manifest, proguard, signing]
+---
+
+# Android Gradle Build Debug
+
+A Gradle failure is usually one of a few causes wearing a long stack trace. Work in this order: find the first real error, check the toolchain versions, then match the error to a section below. Confirm every cause in the build files before proposing a fix.
+
+## 1. Find the first real error
+
+- The useful part is the `* What went wrong:` block and the first `e:` (Kotlin) or `error:` (Java) line. Later failures often cascade from it.
+- Rerun the failing task with more detail when the log is too short: `./gradlew :app:assembleDebug --stacktrace`, then `--info`. Do not suggest `--scan` without telling the user it uploads the build data to a public Gradle service.
+- In Flutter and React Native projects, run Gradle from the `android/` folder, or read the Gradle section of the `flutter build` / `react-native run-android` output.
+
+## 2. Toolchain versions
+
+Most failures after an upgrade are a version mismatch. Collect the versions before theorizing:
+
+| What | Where |
+|---|---|
+| Gradle | `gradle/wrapper/gradle-wrapper.properties` (`distributionUrl`) |
+| Android Gradle Plugin (AGP) | `plugins { id("com.android.application") version ... }`, the version catalog (`gradle/libs.versions.toml`) or `classpath` in the root build file |
+| Kotlin | `org.jetbrains.kotlin.*` plugin version, same places |
+| JDK running Gradle | `./gradlew --version` (the JVM line), `org.gradle.java.home` in `gradle.properties`, `JAVA_HOME`, Android Studio's bundled JDK. Flutter: `flutter doctor -v` shows the Java binary, and `flutter config --jdk-dir` overrides it |
+
+Then check them against each other with the official tables — AGP ↔ Gradle ↔ JDK in the Android Gradle plugin release notes, Gradle ↔ Java in the Gradle compatibility matrix, Kotlin ↔ Gradle/AGP in the Kotlin Gradle plugin docs. Quote the versions you found; do not state a compatibility range from memory.
+
+Typical signatures:
+
+- `Android Gradle plugin requires Java 17 to run. You are currently using Java 11.` → Gradle runs on an older JDK than AGP needs. Fix the JDK Gradle uses, not the app's `compileOptions`.
+- `Unsupported class file major version 65` (or 61, 66...) → a JDK newer than the Gradle version supports (major 61 = Java 17, 65 = Java 21). Upgrade the wrapper or run Gradle on an older JDK.
+- `Minimum supported Gradle version is X. Current version is Y.` → upgrade `distributionUrl` to at least X.
+- `Inconsistent JVM-target compatibility detected for tasks 'compileDebugJavaWithJavac' (1.8) and 'compileDebugKotlin' (17)` → Java and Kotlin target different bytecode levels. Align them, preferably with `kotlin { jvmToolchain(N) }` or matching `compileOptions` and `kotlinOptions.jvmTarget`.
+
+## 3. Dependencies
+
+- [ ] `Could not resolve` / `Could not find` → check the repositories in `settings.gradle(.kts)` (`dependencyResolutionManagement`) and the module build files. `repositoriesMode.set(FAIL_ON_PROJECT_REPOS)` makes module-level `repositories {}` an error. A coordinate that only existed in JCenter will not resolve anymore. Also rule out `--offline` and corporate proxies.
+- [ ] `Duplicate class X found in modules A and B` → two artifacts ship the same classes. Find who brings each: `./gradlew :app:dependencyInsight --dependency <group:name> --configuration debugRuntimeClasspath`. Align versions (a BOM or platform) or exclude the redundant artifact — do not add both.
+- [ ] `Dependency 'X' requires libraries and applications that depend on it to compile against version N or later of the Android APIs` → raise `compileSdk` to N. This is only the compile SDK; `targetSdk` is a separate decision with behavior changes.
+- [ ] Version conflicts after an upgrade: `./gradlew :app:dependencies --configuration debugRuntimeClasspath` shows what Gradle actually picked (`->` marks an upgrade).
+
+## 4. Manifest and module setup
+
+- [ ] `uses-sdk:minSdkVersion A cannot be smaller than version B declared in library X` → a dependency needs a higher `minSdk`. Raising it drops devices below B; say so. `tools:overrideLibrary` only silences the check and crashes at runtime on those devices.
+- [ ] `android:exported needs to be explicitly specified for element <activity ...>` → apps targeting Android 12 (API 31) or higher must set `android:exported` on components with intent filters. Decide per component: `true` only for real entry points (launcher activity, deep links).
+- [ ] `Namespace not specified` → AGP 8 requires `android { namespace = "..." }` in each Android module; the `package` attribute in the manifest is no longer used for it.
+- [ ] `Manifest merger failed` with other messages → read `app/build/intermediates/merged_manifest/<variant>/.../AndroidManifest.xml` and the merger report next to it to see which library contributed the conflicting attribute.
+
+## 5. Annotation processing and code generation
+
+- [ ] kapt or KSP errors after a Kotlin upgrade → KSP releases are built for specific Kotlin versions. Check that the KSP plugin version matches the project's Kotlin version in the KSP release list.
+- [ ] Hilt, Room or Moshi generated code missing → the processor dependency is declared with the wrong configuration (`implementation` instead of `kapt`/`ksp`), or the plugin is not applied in that module.
+
+## 6. Release builds
+
+- [ ] `Missing classes detected while running R8` → R8 writes suggested rules to `app/build/outputs/mapping/<variant>/missing_rules.txt`. Read them before copying: a `-dontwarn` for a class the app really uses turns a build error into a runtime crash.
+- [ ] Release crashes that do not happen in debug → reflection-based libraries stripped by R8; check the library's documented keep rules.
+- [ ] `Keystore file not found` / `signingConfig` errors → the path or password comes from `key.properties` or environment variables that do not exist on this machine or CI. Never suggest committing the keystore or its passwords.
+
+## 7. Environment
+
+- [ ] `Java heap space`, `GC overhead limit exceeded` or `Metaspace` → raise `org.gradle.jvmargs` in `gradle.properties` (for example `-Xmx4g`), and check that parallel builds fit the machine or CI runner.
+- [ ] Errors mentioning corrupted caches or transforms (`Could not read workspace metadata`) → first `./gradlew --stop` and retry. Deleting `~/.gradle/caches` works but forces a full re-download; propose it, do not run it without confirmation.
+
+## Output
+
+Report the first real error, the versions involved, the cause with evidence (`file:line` or the log line), and the minimal fix as a diff or commands. State side effects of the fix, such as a higher minimum Android version or a Gradle upgrade that requires a newer JDK on CI.

package/skills/android-intent-security/SKILL.md

@@ -0,0 +1,550 @@
+---
+name: android-intent-security
+description: Best practices for Android Intent security. Use this skill when auditing
+  component configurations in AndroidManifest.xml activities, services, receivers)
+  or source code handling incoming Intents (getIntent, getParcelableExtra) to prevent
+  Intent Redirection and unauthorized access.
+license: Apache-2.0
+source: https://github.com/android/skills
+intents: [security, review]
+stacks: [android]
+metadata:
+  author: Google LLC
+  last-updated: '2026-08-14'
+  keywords:
+  - recipe
+  - Android
+  - Security
+  - Intent
+  - Redirection
+  - PendingIntent
+  - ContentProvider
+  - Service
+  - Signature
+  - Verification
+  - sanitizer
+  - Vulnerability
+  - Best Practices
+---
+
+This skill provides guidelines and patterns to secure Android components
+(Activities, Services, Broadcast Receivers, Content Providers) and handle
+Intents safely, preventing privilege escalation and unauthorized access.
+
+## Glossary
+
+- **Intent:** An asynchronous messaging object used to request an action from another app component.
+- **Exported component:** A component (`android:exported="true"`) that can be launched by other apps on the device.
+- **Sticky intent:** A broadcast intent that remains in the system cache after it's sent, allowing any app to retrieve its contents.
+- **Signature permission:** A permission whose protection level is set to `signature`, granted only to apps signed with the same developer key.
+- **onNewIntent:** An activity lifecycle callback invoked when an activity is launched with `FLAG_ACTIVITY_SINGLE_TOP` and is already running at the top of the history stack.
+- **PendingIntent:** A token granted to a foreign application (for example, system services) allowing it to execute a predefined Intent with the creator's permissions.
+- **Mutable PendingIntent:** A PendingIntent whose underlying Intent parameters can be modified by the receiving application.
+- **ContentProvider:** A component that encapsulates data and provides it to other applications via standard query/insert interfaces.
+- **IntentSanitizer:** A utility class in AndroidX Core used to build a safe, sanitized copy of an incoming Intent by filtering out unauthorized components, actions, or extras.
+- **Intent redirection (forwarding):** A vulnerability where an application receives an intent from an untrusted source and uses it to launch a private, non-exported component.
+
+## Prerequisites
+
+- The agent **MUST** be able to describe the function and security implications of `onCreate`, `onNewIntent`, and the `singleTop` launch mode.
+- The agent **MUST** be able to declare `<activity>`, `<service>`, `<receiver>`, and `<provider>` tags in `AndroidManifest.xml` and define their `android:exported` and `android:permission` attributes.
+- The agent **MUST** be able to implement signature verification checks using `PackageManager`.
+
+## Limitations
+
+- This skill focuses on local inter-component and inter-app communication security on the Android platform.
+- This skill **doesn't** cover network security, web integration, or host-to-server security.
+
+## Setup and dependencies
+
+- **Android SDK:** Minimum API Level 23 (Android 6.0) is required for standard hardware-backed keystore operations and component validation.
+- **AndroidX Core Library:** `androidx.core:core:1.9.0` or higher is **mandatory** to leverage `IntentSanitizer`.
+- **Standard API access:** Standard Android `PackageManager` APIs are required for runtime component verification.
+
+*** ** * ** ***
+
+## Intent security logic and decisions
+
+### 1. Intent routing comparison
+
+Evaluate the security features of different intent delivery methods:
+
+| Intent Delivery Method | Scope | Recommended Use Case |
+|---|---|---|
+| Explicit Intent (Internal) | App Private | Launching internal activities/services |
+| Implicit Intent | System Wide | Launching system camera, dialer, or sharing |
+| Local Broadcasts (LocalBroadcastManager) (DEPRECATED) | App Private | Internal asynchronous event routing. **Deprecated**: Use in-app observers like Kotlin Flows/SharedFlow, LiveData, or reactive patterns instead. |
+| System Broadcasts | System Wide | Receiving system events (NFC, Bluetooth) |
+
+### 2. PendingIntent mutability flag options
+
+Evaluate the security implications of PendingIntent mutability flags:
+
+| Flag Name | Mutability | Recommended Use Case |
+|---|---|---|
+| `PendingIntent.FLAG_IMMUTABLE` | Immutable | Default for almost all PendingIntents, such as alarms and notifications |
+| `PendingIntent.FLAG_MUTABLE` | Mutable | Inline notifications replies, slice actions (requires explicit target intent) |
+
+### 3. Intent handling and redirection logic
+
+IF (the component receives a nested Intent as an extra) {
+IF (AndroidX Core 1.9.0+ and higher is available) {
+MUST construct an `IntentSanitizer` to explicitly allowlist components, actions, data, and extras.
+MUST call `sanitizeByThrowing()` or `sanitizeByFiltering()` before launching.
+} ELSE {
+MUST verify that the nested Intent's target package matches the current application package.
+MUST verify that the target component of the nested Intent is publicly exported.
+}
+NEVER launch the nested Intent directly without validation.
+} ELSE IF (the component handles broadcasts) {
+MUST rely on the system's Protected Broadcast mechanism for system events (which guarantees the sender is the system framework).
+MUST protect custom receivers with signature-level permissions or use `RECEIVER_NOT_EXPORTED` for dynamic receivers to restrict the sender.
+}
+
+### 4. PendingIntent security logic
+
+IF (a PendingIntent is created for delivery to another application) {
+MUST use `PendingIntent.FLAG_IMMUTABLE` by default.
+IF (the PendingIntent must be mutable) {
+MUST set the explicit target component or package name on the base `Intent`.
+NEVER create an implicit, mutable `PendingIntent`.
+}
+}
+
+### 5. ContentProvider security logic
+
+IF (the ContentProvider is only for internal app use) {
+MUST set `android:exported="false"`.
+} ELSE {
+MUST protect it with `android:readPermission` and `android:writePermission`.
+MUST set `android:grantUriPermissions="false"` unless temporary URL access is strictly required.
+}
+
+### 6. Service caller verification logic
+
+IF (an exported service communicates with trusted sister/partner apps) {
+MUST retrieve the calling UID using `Binder.getCallingUid()` and resolve it to package names using `PackageManager.getPackagesForUid()`.
+MUST verify that the calling package signature fingerprint matches your trusted certificate hash.
+}
+
+*** ** * ** ***
+
+## Code and configuration patterns
+
+### 1. Safe intent redirection (manual verification)
+
+Validate the target of a nested intent before launching it when modern
+sanitization libraries are unavailable.
+
+- **Expected Inputs:**
+  - An incoming `Intent` containing a nested `Intent` extra named `EXTRA_NESTED_INTENT`.
+- **Expected Outputs:**
+  - Launches the target component if safe; throws `SecurityException` if validation fails.
+
+
+```kotlin
+fun safeIntentRedirectionManual() {
+    val nestedIntent = IntentCompat.getParcelableExtra(intent, "EXTRA_NESTED_INTENT", Intent::class.java)
+    if (nestedIntent != null) {
+        // 1. Check for URI permission grants to prevent URI permission bypass
+        val hasUriPermissionGrants = (
+            nestedIntent.flags and (
+                Intent.FLAG_GRANT_READ_URI_PERMISSION or
+                    Intent.FLAG_GRANT_WRITE_URI_PERMISSION or
+                    Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION or
+                    Intent.FLAG_GRANT_PREFIX_URI_PERMISSION
+                )
+            ) != 0
+        if (hasUriPermissionGrants) {
+            throw SecurityException("Nested intent contains forbidden URI permission grant flags!")
+        }
+
+        val pm = packageManager
+        val target = nestedIntent.resolveActivity(pm)
+        if (target != null) {
+            // 2. Verify target is within the same package
+            if (target.packageName != packageName) {
+                throw SecurityException("Cross-app intent redirection is forbidden!")
+            }
+            try {
+                // 3. Verify target activity is exported
+                val info = pm.getActivityInfo(target, 0)
+                if (!info.exported) {
+                    throw SecurityException("Target activity is private: ${target.className}")
+                }
+                // 4. Explicitly set the component to prevent intent interception
+                nestedIntent.component = target
+                // Safe to launch
+                startActivity(nestedIntent)
+            } catch (e: PackageManager.NameNotFoundException) {
+                Log.e("Security", "Failed to resolve target activity", e)
+            }
+        }
+    }
+}
+```
+
+<br />
+
+### 2. Safe intent redirection using IntentSanitizer
+
+Filter or reject dynamic intents using AndroidX `IntentSanitizer` (AndroidX Core
+1.9.0+).
+
+- **Expected Inputs:**
+  - An untrusted incoming `Intent`.
+- **Expected Outputs:**
+  - `Intent`: A sanitized copy containing only allowlisted components, categories, and actions. Throws `SecurityException` on violations if using `sanitizeByThrowing()`.
+
+
+```kotlin
+fun safeIntentRedirectionSanitizer() {
+    val untrustedIntent = IntentCompat.getParcelableExtra(intent, "EXTRA_NESTED_INTENT", Intent::class.java)
+    if (untrustedIntent != null) {
+        // Define the strict boundaries for allowed redirection target
+        val sanitizer = IntentSanitizer.Builder()
+            .allowComponent(ComponentName("com.example.app", "com.example.app.SafeTargetActivity")) // Explicitly allowed target
+            .allowAction(Intent.ACTION_VIEW) // Explicitly allowed actions
+            .allowDataWithAuthority("com.example.app.provider") // Allowed URI authority
+            .allowType("text/plain") // Allowed mime type
+            .allowExtra("user_display_name", String::class.java) // Safe type-enforced extras
+            // Note: URI permission flags are NOT allowed, so the sanitizer will automatically strip or throw on them
+            .build()
+
+        try {
+            // Option A: Throws SecurityException if the intent violates policies
+            val safeIntent = sanitizer.sanitizeByThrowing(untrustedIntent)
+            startActivity(safeIntent)
+        } catch (e: SecurityException) {
+            Log.e("SECURITY_ALERT", "Attempted launch of non-allowlisted intent blocked", e)
+        }
+
+        // Option B: Silently filter and launch only the authorized parts (no exception thrown)
+        // val filteredIntent = sanitizer.sanitizeByFiltering(untrustedIntent)
+        // startActivity(filteredIntent)
+    }
+}
+```
+
+<br />
+
+### 3. Custom signature permission protection
+
+Declare a custom signature-level permission in the manifest to secure family app
+communication.
+
+- **Expected Inputs:** Manifest configuration.
+- **Expected Outputs:** An activity that can only be launched by apps signed with the same developer certificate.
+
+
+```xml
+<permission
+    android:name="com.example.snippets.permission.INTERNAL_COMMUNICATION"
+    android:protectionLevel="signature" />
+```
+
+<br />
+
+
+```xml
+<activity
+    android:name=".intents.InternalSharingActivity"
+    android:exported="true"
+    android:permission="com.example.snippets.permission.INTERNAL_COMMUNICATION">
+    <intent-filter>
+        <action android:name="com.example.snippets.ACTION_SHARE" />
+        <category android:name="android.intent.category.DEFAULT" />
+    </intent-filter>
+</activity>
+```
+
+<br />
+
+### 4. Safe onNewIntent lifecycle verification (warm boot protection)
+
+Ensure that activities reusing dynamic intents (for example, in background
+launch paths) apply the same strict security filters inside `onNewIntent`.
+
+- **Expected Inputs:**
+  - `newIntent` (`Intent`): The newly delivered intent.
+- **Expected Outputs:**
+  - Executes processing logic only if the new intent passes security validation.
+
+
+```kotlin
+override fun onNewIntent(newIntent: Intent) {
+    super.onNewIntent(newIntent)
+
+    // Set the intent to ensure intent returns the new one
+    intent = newIntent
+
+    // Validate the intent payload
+    if (validateIntent(newIntent)) {
+        processIntentPayload(newIntent)
+    } else {
+        Log.w("SECURITY_ALERT", "Received invalid or insecure intent during warm boot")
+    }
+}
+
+private fun validateIntent(intent: Intent): Boolean {
+    return intent.hasExtra("VALID_PAYLOAD_MARKER")
+}
+```
+
+<br />
+
+### 5. Secure PendingIntent creation
+
+Enforce immutability unless mutability is explicitly required.
+
+- **Expected Inputs (Immutable):** An intent target.
+- **Expected Outputs (Immutable):** A `PendingIntent` that cannot be altered by the receiver.
+- **Expected Inputs (Mutable):** An intent with an explicit component set.
+- **Expected Outputs (Mutable):** A mutable `PendingIntent` locked to a specific receiver component to prevent hijacking.
+
+
+```kotlin
+fun createPendingIntents(context: Context) {
+    // 1. Secure Immutable PendingIntent (Default)
+    val intent = Intent(context, TargetActivity::class.java)
+    val pendingIntent = PendingIntent.getActivity(
+        context,
+        0,
+        intent,
+        PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT
+    )
+
+    // 2. Secure Mutable PendingIntent (e.g., Notification Direct Reply)
+    val mutableIntent = Intent().apply {
+        // MUST set explicit target component to prevent redirection hijacking
+        component = ComponentName(context, ReplyReceiver::class.java)
+    }
+    val mutablePendingIntent = PendingIntent.getBroadcast(
+        context,
+        0,
+        mutableIntent,
+        PendingIntent.FLAG_MUTABLE or PendingIntent.FLAG_UPDATE_CURRENT
+    )
+}
+```
+
+<br />
+
+### 6. Secure ContentProvider configuration and queries
+
+Expose a ContentProvider securely and parameterize queries to prevent SQL
+injection.
+
+- **Expected Inputs:**
+  - `uri` (`Uri`): The query URI.
+  - `projection` (`String[]`): Columns to retrieve.
+  - `selection` (`String`): Query criteria.
+  - `selectionArgs` (`String[]`): Values mapping to selection placeholders (`?`).
+- **Expected Outputs:**
+  - `Cursor`: Filtered query results, strictly bound to projection maps.
+
+
+```xml
+<provider
+    android:name=".intents.SecureDataProvider"
+    android:authorities="com.example.snippets.provider"
+    android:exported="true"
+    android:readPermission="com.example.snippets.permission.READ_DATA"
+    android:writePermission="com.example.snippets.permission.WRITE_DATA"
+    android:grantUriPermissions="false" />
+```
+
+<br />
+
+
+```kotlin
+override fun query(
+    uri: Uri,
+    projection: Array<String>?,
+    selection: String?,
+    selectionArgs: Array<String>?,
+    sortOrder: String?
+): Cursor? {
+    val queryBuilder = SQLiteQueryBuilder()
+    queryBuilder.tables = tableName
+    // Strict projection map to prevent querying unauthorized columns
+    queryBuilder.projectionMap = mapOf(
+        "_id" to "_id",
+        "display_name" to "display_name"
+    )
+    // Enable strict validation (always available since minSdk is 36)
+    queryBuilder.setStrict(true)
+    queryBuilder.setStrictColumns(true)
+    queryBuilder.setStrictGrammar(true)
+
+    // MUST parameterize selection criteria; NEVER append selection strings directly
+    val db = dbHelper.readableDatabase
+    return queryBuilder.query(db, projection, selection, selectionArgs, null, null, sortOrder)
+}
+```
+
+<br />
+
+### 7. Service caller signature verification
+
+Verify the calling application's signature before binding to a service.
+
+- **Expected Inputs:**
+  - `intent` (`Intent`): The binding request intent.
+- **Expected Outputs:**
+  - `IBinder`: Local binder instance if caller signature matches trusted partner; throws `SecurityException` otherwise.
+
+
+```kotlin
+class SecureBoundService : Service() {
+    companion object {
+        // Expected SHA-256 hash of the trusted app's signing certificate (Base64 encoded)
+        private const val TRUSTED_PARTNER_SHA256 = "A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V="
+    }
+
+    override fun onBind(intent: Intent): IBinder {
+        // Return the binder. Do NOT perform signature verification in onBind() because
+        // the binder connection is cached by Android, which can bypass checks on subsequent binds.
+        return LocalBinder()
+    }
+
+    private fun enforceTrustedCaller() {
+        val callingUid = Binder.getCallingUid()
+        // Allow calls from the same application
+        if (callingUid == Process.myUid()) {
+            return
+        }
+        val pm = packageManager
+        val packages = pm.getPackagesForUid(callingUid)
+
+        if (packages.isNullOrEmpty() || !verifySignature(pm, packages[0])) {
+            throw SecurityException("Access Denied: Caller signature is untrusted.")
+        }
+    }
+
+    private fun verifySignature(pm: PackageManager, packageName: String): Boolean {
+        try {
+            val trustedSha256Raw = Base64.decode(TRUSTED_PARTNER_SHA256, Base64.DEFAULT)
+            // API 28+ handles rotated certificates and avoids manual hashing.
+            // Since minSdk is 36, this is always available.
+            return pm.hasSigningCertificate(packageName, trustedSha256Raw, PackageManager.CERT_INPUT_SHA256)
+        } catch (e: Exception) {
+            Log.e("SECURITY_ERROR", "Verification failed for package: $packageName", e)
+        }
+        return false
+    }
+
+    inner class LocalBinder : Binder() {
+        fun doSecureWork() {
+            // Verify caller identity on every transaction method call
+            enforceTrustedCaller()
+            // Safe to proceed with sensitive operations
+        }
+    }
+}
+```
+
+<br />
+
+*** ** * ** ***
+
+## Error handling
+
+Handle component binding, database queries, and intent redirection failures
+securely to avoid exposing internal structures.
+
+
+```kotlin
+fun safeErrorHandling(callingPackage: String?) {
+    try {
+        val payload = intent.getStringExtra("DATA_EXTRA") ?: throw IllegalArgumentException("Payload parameter missing.")
+        // Create a specific target intent using the validated payload
+        val targetIntent = Intent(this, TargetActivity::class.java).apply {
+            putExtra("SECURE_PAYLOAD", payload)
+        }
+        startActivity(targetIntent)
+    } catch (e: SecurityException) {
+        // MUST log security violations for audit, but NEVER expose exception details to the user.
+        Log.e("SECURITY_ERROR", "Unauthorized component transition blocked. Calling Package: ${callingPackage ?: "Unknown"}", e)
+        // MUST provide generic user feedback.
+        showFeedbackToUser("Process request failed: Access Denied.")
+    } catch (e: IllegalArgumentException) {
+        Log.w("INTEGRITY_WARNING", "Missing intent parameter", e)
+    }
+}
+```
+
+<br />
+
+    // Secure handling of ContentProvider queries on the client side:
+    try {
+        val cursor = contentResolver.query(providerUri, projection, selection, selectionArgs, null)
+    } catch (e: SQLiteException) {
+        Log.e("PROVIDER_ERROR", "ContentProvider database query failed", e)
+        // Secure handling: prevent raw query syntax details from leaking to UI
+    }
+
+*** ** * ** ***
+
+## Reporting guidelines
+
+When this skill is executed to apply security hardening updates to a codebase,
+the agent **MUST** generate a structured "Best Practices and Security Alignment
+Update" report for the developer. The report **must** be written to the session
+artifact folder (or printed in the final response) and include:
+
+1. **Security alignment area:** The category of improvement applied (for example, Safe Intent Redirection, Secure PendingIntent Configuration, ContentProvider Data Guarding).
+2. **Impact and priority:** The potential safety risk addressed by the update (for example, Component Hijacking Prevention, Private Data Isolation).
+3. **Scope of changes:** A list of all modified classes, XML files, and dependencies.
+4. **Implementation summary:** Concrete details of the solution (for example, "Updated nested intent parsing to use the `IntentSanitizer` API with a strict component allowlist").
+5. **Code diff:** Standard unified diffs showing the exact modifications.
+
+### Best practices and security alignment update template
+
+Use the following markdown template when reporting changes to developers:
+
+    ### Best practices and security alignment update: [Security Alignment Area]
+
+    *   **Improvement Description:** [Brief description of the hardening update and why it's recommended]
+    *   **Priority Level:** [High / Medium / Low]
+    *   **Alignment Action:** [Summary of updates, for example, converted to FLAG_IMMUTABLE]
+
+    #### Files modified
+    *   `[Relative path to File 1]`
+    *   `[Relative path to File 2]`
+
+    #### Implementation diff
+    ```diff
+    // Insert Unified Diff here
+
+#### Testing and verification
+
+1. \[Step 1 to verify the component behaves correctly, for example, run component unit test\]
+2. \[Step 2 to verify regression safety\] \`\`\`
+
+*** ** * ** ***
+
+## Antipatterns
+
+- **NEVER** launch a nested `Intent` received from an untrusted source without verifying its target package and exported status.
+- **NEVER** use sticky broadcasts (`sendStickyBroadcast`).
+- **NEVER** assume an exported component is safe because it runs in a background thread or performs internal checks.
+- **NEVER** expose sensitive functionalities (like SSO authentication or payment processors) to components without signature-level permission restrictions.
+- **NEVER** process incoming intents in `onNewIntent` without applying the same security controls as `onCreate`.
+- **NEVER** create a mutable `PendingIntent` without setting an explicit target component in the base `Intent`.
+- **NEVER** use dynamic string concatenation to construct selection blocks inside a `ContentProvider` query.
+- **NEVER** use `Binder.getCallingUid` inside a `BroadcastReceiver.onReceive` to identify the sender of a broadcast, as it returns the receiver's own UID, not the sender's.
+
+## Best Practices
+
+- **MUST** explicitly set `android:exported="false"` for all components that don't need external communication.
+- **MUST** protect all exported components with custom permissions utilizing `android:protectionLevel="signature"` when communicating between family apps.
+- **MUST** validate all incoming intent extras and handle missing parameters gracefully to prevent crashes.
+- **MUST** rely on the system's **Protected Broadcast** mechanism for system events (for example, boot completed, package changes), as the system prevents untrusted apps from spoofing these actions.
+- **MUST** protect custom broadcasts with signature-level permissions or use `RECEIVER_NOT_EXPORTED` for dynamic receivers to restrict the sender identity.
+- **MUST** call `setIntent(newIntent)` inside `onNewIntent()` before processing payloads to keep active references updated.
+- **MUST** use `PendingIntent.FLAG_IMMUTABLE` by default when constructing `PendingIntent` instances.
+- **MUST** protect exported `ContentProviders` with `readPermission` and `writePermission`.
+- **MUST** enforce parameterized selection structures in `ContentProvider` query/update methods.
+- **MUST** verify the package signature fingerprint of binding applications at runtime inside exported services.
+- **MUST** use `androidx.core.content.IntentSanitizer` to sanitize incoming dynamic intents before redirection, if AndroidX Core 1.9.0+ is imported in the project.