Android NotificationsSAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: android-notifications
description: Integrate Android app notifications using Firebase Cloud Messaging and NotificationCompat. Use when setting up FCM, notification channels, or client-side notification taps; defer Flutter, server sends, WorkManager orchestration, and generic Intent handling.
metadata:
  triggers:
    files:
    - '**/*Notification*.kt'
    - '**/MainActivity.kt'
    keywords:
    - FirebaseMessaging
    - NotificationCompat
    - NotificationChannel
    - FCM
---
# Android Notifications

## **Priority: P2 (MEDIUM)**


## Implementation Guidelines

- **Channels**: Create **`NotificationChannel`** with unique ID (required for **API 26+**). Notifications without valid channel **silently dropped**. Use **`NotificationCompat`** for backwards compatibility.
- **Permissions**: **Explicitly request `POST_NOTIFICATIONS`** on **Android 13+ (API 33)**. Avoid requesting system permission on **app launch**; show **priming dialog** first to explain benefit.
- **Service**: Implement **`FirebaseMessagingService`** with **`onMessageReceived`** and **`onNewToken`** for background push handling. Declare service in **`AndroidManifest`** with `MESSAGING_EVENT` intent action.
- **Flow**: Handle **notification taps in both `onCreate` and `onNewIntent`** using **`PendingIntent`**. Pass data between activities via `Intent` extras.
- **Payload**: Limit notification payload to essential IDs. Perform **background data fetching** via WorkManager if more data needed.

## Anti-Patterns

- **No Missing Channel**: Notifications fail silently without channels on API 26+.
- **No Unconditional Requests**: Don't spam permission dialog on first launch.
- **No Missing Manifest**: Service must declared with `MESSAGING_EVENT` action.

## References

- [Implementation Details](references/implementation.md)

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.