Android NetworkingSAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: android-networking
description: Integrate Retrofit, OkHttp, and Kotlinx Serialization for type-safe API communication in Android. Use when building API clients, adding interceptors, or configuring network security—not standalone MockWebServer or API-test setup.
metadata:
  triggers:
    files:
    - '**/*Api.kt'
    - '**/*Service.kt'
    - '**/*Client.kt'
    keywords:
    - Retrofit
    - OkHttpClient
    - "@GET"
    - "@POST"
---
# Android Networking Standards

## **Priority: P0 (CRITICAL)**

## 1. Configure HTTP Stack

- Use **Retrofit 2** with **OkHttp 4** for all backend communication.
- Use **Kotlinx Serialization** with `@SerialName` for JSON field mapping.
- Implement **Certificate Pinning** for sensitive production domains.

See [setup & wrappers](references/implementation.md) for DTO and API examples.

## 2. Define API Endpoints

- All API calls must `suspend` functions.
- Declare endpoints only in API interface — handle errors in Repository.

See [setup & wrappers](references/implementation.md) for API endpoint definitions.

## 3. Add Cross-Cutting Concerns

- Use OkHttp Interceptors for `Bearer token` injection and `HttpLoggingInterceptor` (debug only).
- Wrap responses with `Result` wrapper or `Either` in Repository layer.
- Define R8/ProGuard rules for Retrofit/OkHttp when `isMinifyEnabled = true`.
- Use **MockWebServer** for unit/integration tests — cover 500, 401, 403 error cases.

## Anti-Patterns

- **No Blocking Network Calls**: All API functions must suspend.
- **No Logic in API Interface**: Only declare endpoints — handle errors in Repository.
- **No Raw Converter Factory**: Explicitly set "application/json" MediaType with kotlinx.serialization.

## References

- [Setup & Wrappers](references/implementation.md)

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.