# Android Exported Components Without Permission

> Detects Android Activities, Services, BroadcastReceivers, and ContentProviders exported without proper permission checks.

- Skill: `zakirkun/android-exported-components-without-permission` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/android-exported-components-without-permission`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/android-exported-components-without-permission/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/android-exported-components-without-permission

---


# Android Exported Components Without Permission

## Overview
Android components (Activity, Service, BroadcastReceiver, ContentProvider) can be declared `exported=true` in AndroidManifest.xml, making them accessible to other applications. Without permission requirements, any installed app can:
- Start sensitive Activities (bypassing login screens)
- Bind to sensitive Services (access internal functionality)
- Trigger BroadcastReceivers (inject events)
- Query ContentProviders (access application data)

## Detection Strategy
- `android:exported="true"` without `android:permission` attribute
- Intent filters implicitly make components exported on older API levels
- ContentProvider with `android:readPermission` or `android:writePermission` missing

## Remediation
- Set `android:exported="false"` for components not intended for external use
- Add `android:permission` with a custom signature-level permission
- Validate caller identity with `checkCallingPermission()` or `checkCallingOrSelfPermission()`