This doesn't look robust for me.

I can create an app offering that activity name but doing nothing. As well, could be a potential leak of information, right now contacts API is privileged, creating a web activity is not, so we could have non privileged apps retrieving mozContact objects.

I think that @fabricedesre gecko patch includes the manifest url, we will need to crosscheck to verify than a specific app is installed (don't like the idea of hard code it but better than nothing)