Fun fact, it is used in Android, but not exposed to the NDK. So C++ applications on Android that wish to use Skia, do have to use the Java API via JNI (android.graphics.Canvas) with the respective performance impact due to marshaling, or package their own Skia version, thus increasing their APK size and having to deal with a build system that only makes sense for Google employees.
This can't be intentional, right?
Everything else should be done at Java level.
I understand from the point of view of security, but what is safer, provide bindings to libraries already validated and installed on the device or forcing devs to package something else?
Also even though they implement native APIs in nice C++ with RAII and stuff, it gets exposed as unsafe C APIs, so the security story isn't 100% correct.