skills/mobile-deep-linking-specialist/SKILL.md
Mobile deep linking specialist for Universal Links, App Links, deferred deep links, and attribution. Activate on: deep linking, Universal Links, App Links, deferred deep link, app attribution, URL scheme, branch.io, dynamic links, app clip. NOT for: web routing (use frontend-architect), push notification handling (use mobile-push-notification-expert), API URL design (use api-architect).
npx skillsauth add curiositech/windags-skills mobile-deep-linking-specialistInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Expert in implementing deep linking across iOS and Android with Universal Links, App Links, deferred deep links, and attribution tracking.
Input: App requirements and constraints
├─ Simple link tracking + basic install attribution?
│ └─ YES → Use Branch.io (quick setup, free tier)
│ └─ NO → Continue
├─ Enterprise with complex attribution models?
│ └─ YES → Use Adjust or AppsFlyer (advanced features)
│ └─ NO → Continue
├─ Privacy-first, minimal data collection?
│ └─ YES → Custom solution with SKAdNetwork only
│ └─ NO → Use Branch.io
Target Platform Analysis:
├─ iOS 14+ with ATT restrictions?
│ ├─ HIGH privacy users → Clipboard method (user consent required)
│ └─ LOW privacy users → Fingerprint method (limited accuracy)
├─ Android with Play Install Referrer API?
│ └─ Use Play Install Referrer (most reliable)
├─ Cross-platform consistency needed?
│ └─ Use Branch.io or Adjust SDK (abstracts platform differences)
App State When Link Clicked:
├─ App not installed?
│ ├─ Marketing campaign → Smart app banner + deferred deep link
│ └─ User sharing → Direct app store link with custom params
├─ App installed but closed?
│ ├─ Universal/App Link configured → Direct app open
│ └─ No Universal Links → Custom URL scheme with fallback
├─ App running in background?
│ └─ Use Linking.addEventListener for immediate navigation
Scenario: User receives SMS link to product, app not installed
Link Analysis: https://shop.example.com/product/nike-air-max
Attribution Choice Decision:
Requirements: Track SMS campaign performance + deferred deep links
Privacy constraints: Moderate (e-commerce, some user tolerance)
→ Decision: Branch.io (good SMS attribution + easy deferred setup)
Implementation Trade-offs:
Setup Walkthrough:
// 1. AASA file includes Branch domains
"applinks": {
"details": [{
"appIDs": ["TEAMID.com.shop.example"],
"components": [
{ "/": "/product/*" },
{ "/": "https://shop.app.link/*" } // Branch domain
]
}]
}
// 2. Navigation config with deferred handling
const linking = {
prefixes: ['https://shop.example.com', 'https://shop.app.link'],
config: { screens: { Product: 'product/:id' } },
async getInitialURL() {
const branchData = await branch.getFirstReferringParams();
if (branchData?.'+clicked_branch_link') {
return `https://shop.example.com${branchData.$deeplink_path}`;
}
return await Linking.getInitialURL();
}
};
Expert Optimization: Pre-load product data during app install to reduce perceived navigation delay
adb shell am start -W -a android.intent.action.VIEW -d "https://example.com/test"frontend-architect for SPA routingmobile-push-notification-expert for notification processingapi-architect for REST/GraphQL URL structuremobile-app-store-expert for app submission settingsauth-specialist for login redirect handlingtools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.