Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agents国内App隐私合规预检 Gate | China App Privacy
Find the Android code that gets apps named in 工信部 notices or rejected by 华为/小米 — SDK init before consent, ID & app-list reads, permission timing, self-start. file:line fixes.
$24
国内App隐私合规预检 Gate | China App Privacy
Example session with this skill installed
我们是电商App，下周上架华为和小米，帮我做个隐私合规自查。隐私政策里写了收集位置和设备信息，第三方SDK清单还没做。
[project: ./shop-android — Kotlin, app/src/main]
(Fictional test project.)
- Read your context and instructions
- Compiled the app gate
App隐私合规预检报告 | com.demo.shop（电商App）
检查范围： 源码（AndroidManifest.xml + Kotlin/Java）；隐私政策全文、两个清单、备案状态未提供 → 未核实
1. 结论
BLOCK：用户点"同意"前，App 已初始化 3 个第三方SDK、读取 ANDROID_ID、批量申请 3 项危险权限、读取应用列表和剪贴板；开机广播还会在用户从未打开 App 的情况下启动保活服务并每 60 秒请求一次 GPS。第三方SDK清单尚未制作，代码实际收集的应用列表、剪贴板、通讯录权限、后台定位与隐私政策不一致。
静态代码审查不能替代动态检测，请在发布包上运行应用商店预检。
2. 同意前行为
关键时序：showPrivacyDialog() 在 SplashActivity.kt:10，排在权限申请、应用列表和剪贴板读取之后；ShopApp.onCreate 更早执行，且没有任何同意标志判断。
| 位置 | 行为 | 通报类别 | 修改 |
|---|---|---|---|
ShopApp.kt:7-9 | 同意前初始化统计、推送、崩溃 SDK | 违规收集个人信息 | 移到同意后；各 SDK 的延迟初始化方式请对照其合规指南（未核实） |
ShopApp.kt:10-11 | 同意前读取 ANDROID_ID 并传给分析组件 | 违规收集个人信息 | 删除；同意后按需获取，并写入收集清单 |
SplashActivity.kt:7 | 启动页一次性申请 电话/定位/通讯录 权限，早于隐私弹窗 | 强制、频繁、过度索取权限 | 删除；在对应功能触发时单项申请 |
SplashActivity.kt:8 | 同意前 getInstalledPackages | 超范围收集个人信息 | 删除；如有真实场景用 <queries> 声明特定包并去掉 QUERY_ALL_PACKAGES |
SplashActivity.kt:9, 12 | 启动和每次 onResume 读取剪贴板 | 违规收集个人信息 | 删除；口令识别只在用户点击后触发 |
BootReceiver.kt:4-6 | 开机启动保活服务，每 60 秒请求 GPS | 违规收集；频繁自启动；后台高频定位 | 整体删除 |
同意闸门思路（Kotlin）：
class ShopApp : Application() {
override fun onCreate() {
super.onCreate()
if (PrivacyGate.agreed(this)) SdkInitializer.initAfterConsent(this)
// 否则什么都不初始化，等用户在隐私弹窗点“同意”后再调用
}
}
3. 文档与代码一致性
- 隐私政策只写"设备信息"过于模糊，需列明 ANDROID_ID 等具体标识
- 第三方共享清单：缺失，需列出每个 SDK 的名称、公司、用途、收集字段和政策链接
- 精确定位轨迹属敏感个人信息，需单独同意
- 电商个性化推荐需提供非个性化选项（电子商务法第十八条）
- App 备案：未核实
4. 复测清单
- 首次启动未点"同意"前：无 SDK 初始化、无设备标识读取、无权限弹窗
- 权限仅在对应功能触发时申请；拒绝后不重复弹出
- 无自启动、关联启动、后台高频定位
- 在发布包上运行华为、小米的上架前检测
5. 限制说明
- 闭源 SDK 内部行为未核实，请对照各 SDK 合规指南。
- 本报告为工程层面的合规预检，不构成法律意见。
Connects securely to your tools. The creator never sees your data.
About this skill
Most Chinese app-store privacy rejections and MIIT 侵害用户权益 notices come down to a few lines of code: third-party SDKs initialized in Application.onCreate before the user taps 同意, ANDROID_ID or the installed-app list read on launch, three permissions requested on the splash screen, a boot receiver that keeps the app alive. MIIT has named dozens of apps and SDKs in each 2026 batch for exactly these patterns.
这个 skill 扫描你的 Android 工程，找出同意前采集、SDK 初始化顺序、设备标识和应用列表读取、权限申请时机、自启动和关联启动、弹窗问题，并对照隐私政策和两个清单，给出具体到行的修改。
What it checks | 检查内容
- Pre-consent behavior — SDK init and ID calls in
Application.onCreate/attachBaseContext, ContentProvider auto-init andandroidx.startup; anything in the splash activity before the privacy dialog - Sensitive reads — IMEI/ANDROID_ID/OAID/MAC, installed-app list, clipboard, location, contacts, carrier and cell info
- Permissions — batch requests at launch, re-asking after denial, permissions with no feature,
QUERY_ALL_PACKAGES - Self-start & linked launch — boot receivers, keep-alive, scheduled work, starting other apps
- Pop-ups — ads without a close button, shake-to-jump
- Docs vs code — privacy policy, 个人信息收集清单, 第三方共享清单 vs what the code and SDKs actually collect; account deletion; 备案
- PIPL sensitive data — separate consent (单独同意) for location tracks, biometrics, financial accounts, minors
What you get
- A bundled static scanner (stdlib Python) for Java/Kotlin + manifests — every hit then confirmed by reading the code
- PASS / REVISE / BLOCK mapped to the MIIT notice categories, with file:line and a code sketch for each fix (including a consent-gate pattern)
- Permission, SDK and doc-vs-code tables, plus a retest checklist
Honest limits: a static review isn't a detection report — run your store's pre-check on the release build. Closed-source SDK internals are marked 未核实 with a pointer to each vendor's compliance guide; vendor APIs are never guessed. The 2026 CAC draft rules are cited as a draft only. Not legal advice.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 3 days ago
- Passed all security checks, Safe to install