android-skills

A collection of Claude Code skills for Android app and game development.

A Claude Code plugin marketplace bundling Android-focused skills. New skills will be added over time. Currently included:

• `android-go-live-checklist` - generates and walks you through a Play Store launch checklist, customized to your project (native, Flutter, React Native, Unity, etc.).
• `android-plan-reviewer` - validates an Android implementation plan by spawning parallel review agents that check every section against your real Android codebase (gradle deps, manifest, ProGuard, SDK levels, Compose vs Views) and against current Android / Play Console / Jetpack guidance from the web.
• `android-code-auditor` - audits an Android project for Security, Performance, Architecture, and Dependency issues using parallel domain agents and live web research. Produces a severity-ranked code-audit.md with per-item status tracking.

Each skill exits early if the working directory is not an Android project.

Install

Marketplace (recommended)

/plugin marketplace add calvin-iyer/android-skills
/plugin install android-skills@android-skills

That installs both skills in one step. Update later with:

/plugin marketplace update android-skills

Manual

Clone the repo and symlink each skill into your local ~/.claude/skills/:

git clone https://github.com/calvin-iyer/android-skills.git
cd android-skills
ln -s "$PWD/plugins/android-skills/skills/android-go-live-checklist" ~/.claude/skills/android-go-live-checklist
ln -s "$PWD/plugins/android-skills/skills/android-plan-reviewer"     ~/.claude/skills/android-plan-reviewer
ln -s "$PWD/plugins/android-skills/skills/android-code-auditor"      ~/.claude/skills/android-code-auditor

Skills

android-go-live-checklist

Generate, maintain, and walk through a Play Store launch checklist (go-live-checklist.md) for any Android app or game.

Modes:

What it does:

• Detects Android stack (native, Flutter, RN, Unity, Capacitor) - exits if not Android.
• Researches current Play Console publishing requirements on the web.
• Scans the codebase for pending work and manual setup items: IAP products, Firebase rules, signing config, ProGuard, privacy policy, target SDK, content rating, data safety form, etc.
• Produces a severity-ranked checklist file at go-live-checklist.md.

Optional integrations:

• code-review-graph MCP - if installed, the skill uses get_architecture_overview_tool, semantic_search_nodes_tool, and query_graph_tool for the codebase analysis pass instead of raw Grep/Read. Faster scans, fewer tokens, and structural context (callers, dependents, modules) that flat file search cannot give. Falls back to Grep/Read when not present.

Example invocation:

> /android-skills:android-go-live-checklist
> "Generate a Play Store launch checklist for this app"

Sample output (excerpt):

## Critical (must fix before launch)
- [ ] targetSdk is 31; Play Console requires 34+ as of Aug 2024
- [ ] No privacy policy URL set in Play Console listing

## Important
- [ ] ProGuard rules missing for Retrofit reflection - likely R8 strip in release
- [ ] Data Safety form not yet submitted

## Manual setup
- [ ] Create signing key (`keystore.jks`) and configure `signingConfigs.release`
- [ ] Define managed IAP products in Play Console

android-plan-reviewer

Validates an Android implementation plan by spawning one parallel review agent per section. Each agent checks its section against the real Android codebase and current Android industry guidance, then applies inline corrections to the plan file. Loops until clean or until max iterations is hit.

Trigger phrases:

• "review plan", "validate plan", "check my plan", "audit plan", "plan review"
• "review Android plan", "validate Android implementation plan", "check gradle migration plan"
• "review this" while pointing at an Android plan file

What each review agent checks:

• Codebase validation - file paths, function/class names, gradle dependencies and versions, AndroidManifest entries, ProGuard rules, signing config, compileSdk/minSdk/targetSdk, UI stack (Compose vs Views), cross-platform bridges (Flutter/RN/Unity).
• Web research - current Android SDK target, Jetpack/Compose BOM versions, Play Console policy, Play Billing Library version, Material 3 guidance, Firebase BoM, AGP/Kotlin/Gradle compatibility, deprecated APIs, security CVEs, official Android Developer docs.

Example invocation:

> /android-skills:android-plan-reviewer
> "Review docs/plans/billing-migration.md, max 3 passes"

Sample issue output (one of many per pass):

ISSUE:
- Section: "Wire up Play Billing"
- Location: "Use com.android.billingclient:billing:5.1.0"
- Problem: Billing Library 5.x reaches end of support; new submissions require 7.x.
- Correction: "Use com.android.billingclient:billing:7.1.1"
- Source: https://developer.android.com/google/play/billing/release-notes
- Severity: critical

android-code-auditor

Audits an Android project for Security, Performance, Architecture, and Dependency issues. Spawns parallel domain agents (or runs sequentially at your choice) - each agent does a deep codebase scan and live web research for its domain. Findings go into a severity-ranked, status-tracked code-audit.md file at repo root.

Modes:

What each domain agent checks:

• Security - hardcoded secrets, unprotected exported components, insecure network config, WebView misuse, deeplink hijacking, overly broad permissions, unencrypted key storage, weak crypto
• Performance - main thread I/O and network, memory leaks, Compose recomposition issues, large assets, heavy Application.onCreate, GlobalScope misuse
• Architecture - ViewModel-View coupling, missing repository layer, god classes, coroutine scope leaks, missing SavedStateHandle, DI inconsistency
• Dependencies - outdated libraries (vs Maven Central / Google Maven), known CVEs (via osv.dev), deprecated Gradle configs, AGP/Kotlin/Gradle compatibility

Optional integrations:

• code-review-graph MCP - if installed, domain agents use get_architecture_overview_tool, semantic_search_nodes_tool, and query_graph_tool for the codebase scan instead of raw Grep/Read. Falls back to Grep/Read when not present.

Example invocation:

> /android-skills:android-code-auditor
> "Audit my code"
> "Run a security audit on this Android app"

Sample output (excerpt):

## CRITICAL

### [PENDING] C1. Hardcoded API key in source
**Domain:** Security
**What:** Production API key hardcoded as string literal.
**Why critical:** Key is exposed in version control and any decompiled APK.
**Where:** `app/src/main/java/com/example/api/ApiClient.kt:14`
**How to fix:** Move to `local.properties`, read via `BuildConfig` field set in `build.gradle`.
**Reference:** https://developer.android.com/privacy-and-security/security-tips#UserData

### [PENDING] C2. Exported Activity with no permission
**Domain:** Security
**What:** `DeepLinkActivity` is exported without android:permission.
**Why critical:** Any app on device can launch this Activity and trigger deeplink flows.
**Where:** `app/src/main/AndroidManifest.xml:34`
**How to fix:** Add `android:permission="com.example.permission.DEEPLINK"` or set `android:exported="false"` if not needed externally.
**Reference:** https://developer.android.com/privacy-and-security/risks/android-exported

Requirements

• Claude Code - installed and configured.
• Android project - all skills exit early if no Android project markers are detected (android/ dir, app/build.gradle*, AndroidManifest.xml, Flutter/RN/Unity/Capacitor markers).

Updating

/plugin marketplace update android-skills

Pulls the latest catalog and offers updates for installed plugins.

Contributing

Issues and PRs welcome at https://github.com/calvin-iyer/android-skills.

License

MIT © 2026 Calvin Iyer