android-review
AGENTS.md17 starsChanged 9 months agoMITView on GitHub
Expert-level Android code review across seven domains: architecture, Compose UI, Kotlin quality, performance, security, privacy compliance, and Google Play compliance. Each domain is a self-contained skill under skills/<name>/, driven by a SKILL.md with detailed reference docs loaded on demand. This file is the entry point for Codex CLI and any agent that reads AGENTS.md. The same skills also ship as a Claude Code plugin (see .claude-plugin/). Each skill lives in skills/<name>/SKILL.md. Load the matching skill when the task fits its…
Where files are headingNew AGENTS.md files have more rules about keeping secrets out of the code, and fewer about code style.
Of the AGENTS.md files we read, the 31,700 first seen in the last six months, against the older ones: the kind of rule that gained most share, and the kind that lost most. About files like this in general, not this one, and an estimate, since a kind is a pattern in the words.
In this repository7 other files it gives its agents.
- architectureSkill
- compose-uiSkill
- kotlin-qualitySkill
- performanceSkill
- play-storeSkill
- privacy-auditSkill
- security-auditSkill
The file
We split this AGENTS.md into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 46
Run it from the target Android project root.
≈ “Common” is an estimate: at least 1 in 5 of the 40,246 AGENTS.md files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Android Review — Agent Guide
Expert-level Android code review across seven domains: architecture, Compose UI,
Kotlin quality, performance, security, privacy compliance, and Google Play
compliance. Each domain is a self-contained skill under skills/<name>/, driven
by a SKILL.md with detailed reference docs loaded on demand.
This file is the entry point for Codex CLI and any agent that reads AGENTS.md.
The same skills also ship as a Claude Code plugin (see .claude-plugin/).
Skills
Each skill lives in skills/<name>/SKILL.md. Load the matching skill when the
task fits its trigger, then read files under that skill's references/ only when
the review reaches that topic (progressive disclosure — do not preload everything).
| Skill | Path | Load when |
| architecture | skills/architecture/SKILL.md | Designing app structure; creating ViewModel/Repository/UseCase; setting up Hilt DI; planning module boundaries; reviewing layer dependencies; offline-first data; error-handling strategy; starting a new feature module. |
| compose-ui | skills/compose-ui/SKILL.md | Writing or reviewing Compose UI; state hoisting; side effects (LaunchedEffect, DisposableEffect); type-safe navigation; responsive layouts; accessibility; animations; reusable composables. |
| kotlin-quality | skills/kotlin-quality/SKILL.md | Reviewing Kotlin in PRs; auditing coroutine/structured concurrency; Flow operators; null safety; type design (sealed/data/value classes); collection & functional patterns. |
| performance | skills/performance/SKILL.md | Cold start > 500ms; UI jank; memory leaks/OOM; ANR rate > 0.47%; recomposition waste; missing baseline profiles; battery drain; pre-release performance review. |
| play-store | skills/play-store/SKILL.md | Pre-submission Google Play compliance; permissions; Data Safety; Financial Features Declaration / loan apps; sensitive-permission and spyware policy; account deletion; code-level audit. Updated for the 2025-2026 policy cycle. |
| privacy-audit | skills/privacy-audit/SKILL.md | Three-way privacy compliance audit for loan apps: privacy policy vs in-app disclosure dialogs vs code implementation; banned loan-app permissions; READ_SMS filtering; third-party SDK data sharing. Runs a fixed 5-step workflow and writes a report file. |
| security-audit | skills/security-audit/SKILL.md | Sensitive-data storage; cryptography/Keystore; authentication/biometrics; network security (TLS, cert pinning); WebView hardening; Content Provider security; RE resilience; user privacy. OWASP MASVS v2.0. |
How reviews work
Each skill runs a structured audit and emits findings with a domain prefix and severity, for example:
[ARCH-LAYER-001] severity: HIGH
location: data/repository/UserRepositoryImpl.kt:42
issue: Domain layer imports Android framework class (android.content.Context)
fix: Inject an interface that wraps Context-dependent operationsPrefixes: [ARCH-*], [COMPOSE-*], [KT-*], [PERF-*], [GP-*],
severity-based output for security-audit, and a written three-way comparison
report (privacy-audit-report-[YYYY-MM-DD].md) for privacy-audit.
Scripts
skills/play-store/scripts/audit.sh— automated grep-based Play Store audit. Run it from the target Android project root; it flags manifest, permission, and build-config issues for the play-store skill to interpret.
Setup
- Codex CLI:
codex plugin marketplace add https://github.com/liuyi0808/android-reviewthencodex plugin add android-review@android-review, then restart Codex. Or reference thisAGENTS.mddirectly from a project that vendors this repo. - Claude Code:
claude plugin marketplace add liuyi0808/android-reviewthenclaude plugin install android-review.
The skills/ directory is the single source of truth for both platforms.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.