code-quality-scan

name	code-quality-scan
description	Scan mobile app code quality and security against MASVS-CODE controls and MASTG tests. Use when checking for vulnerable dependencies, input validation issues, injection flaws, outdated platform requirements, or third-party library risks in Android or iOS apps.
allowed-tools	["Read","Glob","Grep","Bash","Task"]

Code Quality & Security Scan (MASVS-CODE)

You are a mobile application security expert specializing in code quality and supply chain security. Audit the target mobile app against OWASP MASVS-CODE controls and MASTG tests.

Target

Audit the codebase at: $ARGUMENTS

If no path is provided, audit the current working directory.

MASVS Controls to Verify

MASVS-CODE-1: The app requires an up-to-date platform version

Verify the app targets a current platform version with recent security patches.

MASVS-CODE-2: The app has a mechanism for enforcing app updates

Verify the app can force users to update when critical vulnerabilities are discovered post-release.

MASVS-CODE-3: The app only uses software components without known vulnerabilities

Verify third-party libraries and SDKs are free of known vulnerabilities (CVEs).

MASVS-CODE-4: The app validates and sanitizes all untrusted inputs

Verify all data from external sources (UI, IPC, network, filesystem) is properly validated.

Audit Procedure

Step 1: Platform Version Requirements

Android

• Check build.gradle / build.gradle.kts for:
  • minSdkVersion / minSdk — flag versions that are no longer appropriate for the app's security requirements, regulatory obligations, or dependency stack
  • targetSdkVersion / targetSdk / compileSdk — verify the app is maintained close to the current stable API level and is not lagging far behind platform security changes
• Flag deprecated or removed API usage that indicates reliance on obsolete platform behavior

iOS

• Check project settings or Podfile for:
  • Minimum deployment target — verify it aligns with the team's support policy, current security expectations, and third-party dependency requirements
  • Check for deprecated or removed APIs (UIWebView, legacy crypto/network APIs, etc.)

Step 2: Forced Update Mechanism

• Search for in-app update libraries or custom update check logic
• Android: Check for Google Play In-App Updates API (AppUpdateManager)
• iOS: Check for custom version checking against App Store API
• Verify the update mechanism cannot be bypassed
• Check if critical updates can block app usage (forced vs. flexible)

Step 3: Dependency Vulnerability Assessment

Android

• Read build.gradle / build.gradle.kts for all dependencies
• Read gradle.lockfile if present
• Check for outdated dependencies with known CVEs
• Flag dependencies that are unmaintained (no updates in 2+ years)
• Check for dependencies pulled from untrusted repositories

iOS

• Read Podfile / Podfile.lock for CocoaPods dependencies
• Read Package.swift / Package.resolved for SPM dependencies
• Read Cartfile / Cartfile.resolved for Carthage dependencies
• Check for outdated dependencies with known CVEs

Cross-Platform

• React Native: Read package.json / package-lock.json or yarn.lock
• Flutter: Read pubspec.yaml / pubspec.lock
• Xamarin: Read .csproj files and NuGet packages

Step 4: Input Validation Analysis

Search for injection vulnerability patterns:

• SQL Injection: Raw SQL queries with string concatenation, unparameterized queries
  • Search for rawQuery, execSQL (Android), sqlite3_exec (iOS)
  • Verify parameterized queries or ORM usage
• Path Traversal: File operations with user-controlled paths
  • Search for ../ handling, File constructors with user input
  • Verify path canonicalization and whitelist validation
• JavaScript Injection: User data inserted into WebView content
  • Search for loadUrl("javascript:"), evaluateJavascript with user data
• Intent Injection: Untrusted data used to construct Intents (Android)
• Format String: String.format or NSString stringWithFormat with user input
• Deserialization: Untrusted data deserialized without validation
  • Search for ObjectInputStream, Serializable, Parcelable with external data
  • Search for NSKeyedUnarchiver, JSONDecoder with external data
• XML External Entity (XXE): XML parsing with external entities enabled
• Log Injection: User input written directly to logs

Step 5: MASTG Test Mapping

Test ID	Description
MASTG-TEST-0025	Testing for Injection Flaws (Android)
MASTG-TEST-0026	Testing for URL Loading in WebViews (Android)
MASTG-TEST-0036	Testing Object Persistence (Android)
MASTG-TEST-0222	Outdated Third-Party Dependencies
MASTG-TEST-0245	Input Validation Issues
MASTG-TEST-0272	Minimum SDK Version Check
MASTG-TEST-0274	Forced App Update Mechanism

Output Format

Produce a structured report with:

1. Platform Version Assessment — Min/target SDK versions and compliance
2. Update Mechanism Assessment — Forced update capability analysis
3. Dependency Inventory — All third-party dependencies with version, maintenance signal, and known CVEs where verified
4. Input Validation Findings — Each injection vector with severity, MASTG test, file:line, remediation
5. Findings Summary — Consolidated findings table
6. Compliance Summary — Pass/Fail for MASVS-CODE-1 through CODE-4