القائمة
Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In.
Deep audit of code quality and supply chain security against OWASP MASVS-CODE controls. Use when modifying libs.versions.toml dependencies, minSdk, R8/ProGuard rules, or input validation logic. This is the primary skill for Detekt-detectable issues.
Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain.
Generate a STRIDE threat model for Dividox mapped to MASVS controls with NowSecure risk tiering. Use when designing new features with a significant security surface, or for periodic threat reviews.
Deep audit of network communication security against OWASP MASVS-NETWORK controls. Use when code configures HTTP clients (Ktor, OkHttp), touches TLS, certificates, or network_security_config.xml.
Deep audit of platform interaction security against OWASP MASVS-PLATFORM controls. Use when code touches deep links, Intents, exported components, WebViews, or AndroidManifest/Info.plist.
| name | masvs-checklist |
| description | Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture. |
Context: See
.ai-context/security-instructions.mdfor Dividox security profile (Tier 2 fintech — all controls except RESILIENCE are required).
Generate a MASVS_CHECKLIST.md for the current state of the Dividox codebase, covering
all 8 MASVS v2 categories with per-control MASTG test mappings and compliance status.
For each category below, invoke the corresponding deep-audit skill to populate findings, then aggregate into the compliance matrix.
| Step | Action | Skill |
|---|---|---|
| 1 | Storage audit | skill: masvs-secure-storage-audit |
| 2 | Crypto audit | skill: masvs-crypto-review |
| 3 | Auth audit | skill: masvs-auth-assessment |
| 4 | Network audit | skill: masvs-network-security-check |
| 5 | Platform audit | skill: masvs-platform-interaction-review |
| 6 | Code quality audit | skill: masvs-code-quality-scan |
| 7 | Privacy audit | skill: masvs-privacy-audit |
| 8 | Resilience (optional) | skill: masvs-resilience-assessment |
MASVS_CHECKLIST.md# MASVS v2 Compliance Checklist — Dividox
**Date**: {date}
**App version**: {version}
**Tier**: 2 (Handles PII and Financial Data)
## Compliance Matrix
| Category | Control | Status | MASTG Test | Notes |
|----------|---------|--------|------------|-------|
| MASVS-STORAGE | STORAGE-1 | ✅ PASS / ⚠️ WARN / ❌ FAIL | MASTG-TEST-0001 | |
| MASVS-STORAGE | STORAGE-2 | | MASTG-TEST-0002 | |
| MASVS-CRYPTO | CRYPTO-1 | | MASTG-TEST-0013 | |
| MASVS-CRYPTO | CRYPTO-2 | | MASTG-TEST-0014 | |
| MASVS-AUTH | AUTH-1 | | MASTG-TEST-0068 | |
| MASVS-AUTH | AUTH-2 | | MASTG-TEST-0016 | |
| MASVS-AUTH | AUTH-3 | | MASTG-TEST-0018 | |
| MASVS-NETWORK | NETWORK-1 | | MASTG-TEST-0020 | |
| MASVS-NETWORK | NETWORK-2 | | MASTG-TEST-0022 | |
| MASVS-PLATFORM | PLATFORM-1 | | MASTG-TEST-0028 | |
| MASVS-PLATFORM | PLATFORM-2 | | MASTG-TEST-0031 | |
| MASVS-PLATFORM | PLATFORM-3 | | MASTG-TEST-0035 | |
| MASVS-CODE | CODE-1 | | MASTG-TEST-0041 | |
| MASVS-CODE | CODE-2 | | MASTG-TEST-0041 | |
| MASVS-CODE | CODE-3 | | MASTG-TEST-0039 | |
| MASVS-CODE | CODE-4 | | MASTG-TEST-0005 | |
| MASVS-PRIVACY | PRIVACY-1 | | MASTG-TEST-0005 | |
| MASVS-PRIVACY | PRIVACY-2 | | MASTG-TEST-0006 | |
| MASVS-PRIVACY | PRIVACY-3 | | MASTG-TEST-0057 | |
| MASVS-PRIVACY | PRIVACY-4 | | MASTG-TEST-0057 | |
## Summary
- ✅ PASS: {n}
- ⚠️ WARN: {n}
- ❌ FAIL: {n}
- Overall verdict: COMPLIANT / NON-COMPLIANT
## Remediation Roadmap (by priority)
1. [FAIL items — must fix before release]
2. [WARN items — fix within next sprint]
3. [Recommendations for Tier 3 upgrade]
This checklist is static analysis only. Dynamic testing (Frida instrumentation, proxy traffic inspection, device-level testing) is needed for full MASVS certification.