Make the receiver's trust boundary explicit: ```xml <receiver android:name=".InternalReceiver" android:exported="false" /> ``` Use `android:exported="false"` when the receiver is only for broadcasts from your own app. If it has an `intent-filter`, Android 12+ requires an explicit exported value, so do not leave the attribute implicit. Set `android:exported="true"` only when external apps or the system must invoke it. In that case, restrict access with the narrowest appropriate permission (pre...
Scanned 9/5/2026
Install to Claude Code
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill android-security --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Android Security?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-android-security-8fc131d8)More formats (shields.io, HTML) on the badges page.
# `BroadcastReceiver` and `android:exported`
Make the receiver's trust boundary explicit:
```xml
<receiver
android:name=".InternalReceiver"
android:exported="false" />
```
Use `android:exported="false"` when the receiver is only for broadcasts from your own app. If it has an `intent-filter`, Android 12+ requires an explicit exported value, so do not leave the attribute implicit.
Set `android:exported="true"` only when external apps or the system must invoke it. In that case, restrict access with the narrowest appropriate permission (prefer a signature-level permission for trusted callers), use explicit broadcasts for internal flows, and treat every incoming action, extra, URI, and type as untrusted input. Validate the expected schema and reject unexpected callers/data. Do not expose sensitive operations or data through an unnecessarily exported receiver.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
