// Autonomous mobile security audit aligned with OWASP MASTG v2. Performs checklist-driven analysis across MASVS categories: storage, crypto, network, platform, code, resilience, privacy. Exports structured markdown report with MASTG test references.
| name | mastg |
| description | Autonomous mobile security audit aligned with OWASP MASTG v2. Performs checklist-driven analysis across MASVS categories: storage, crypto, network, platform, code, resilience, privacy. Exports structured markdown report with MASTG test references. |
You are performing an autonomous security audit of a mobile application using igf (Grapefruit) dynamic instrumentation, aligned with OWASP MASTG v2 (Mobile Application Security Testing Guide).
The igf server must be running (bun src/index.ts or igf). A device must be connected with the target app running.
igf device list to find connected devicesdroid or fruity) and bundle IDStore as shell variables:
DEVICE="<device_id>"
PLATFORM="<droid|fruity>"
BUNDLE="<bundle_id>"
SESSION="-d $DEVICE --platform $PLATFORM -b $BUNDLE"
Use igf CLI via bash. The /igf skill documents all commands.
Rules:
pin start, hook start)Work through sections in order. Non-intrusive first (1-4, 6), hooks later (5, 7, 8).
Platform: [A] = Android, [I] = iOS, [*] = both.
Collect app info and filesystem roots: Run the platform-specific app metadata command plus the shared process/filesystem commands:
igf agent app process-info $SESSION
igf agent app info $SESSION # Android
igf agent app plist $SESSION # iOS
igf agent fs roots $SESSION
1.1 Logging [*] (MASWE-0001)
igf log syslog $DEVICE $BUNDLEigf log syslog $DEVICE $BUNDLE1.2 Backup Exposure [*] (MASWE-0004)
android:allowBackup in manifest — igf agent app manifest $SESSION1.3 Unencrypted Data in Private Storage [*] (MASWE-0006)
igf agent fs ls <data_dir>/shared_prefs $SESSION then igf agent fs cat <file> $SESSIONigf agent sqlite tables <path> $SESSION then igf agent sqlite dump <path> <table> $SESSIONigf agent ios userdefaults $SESSION1.4 External/Shared Storage [*] (MASWE-0007)
igf agent fs ls <data_dir> $SESSION1.5 Keychain/Keystore [*]
igf agent android keystore $SESSION — check key algorithms, purposesigf agent android keystore-info <alias> $SESSION — detailed attributesigf agent ios keychain $SESSION — check accessibility levelsigf agent ios cookies $SESSION — session cookies without secure/httpOnlykSecAttrAccessibleAlways (HIGH), weak key algorithms2.1 Weak/Broken Algorithms [*] (MASWE-0020)
2.2 Hardcoded Keys [*] (MASWE-0014)
igf agent symbol strings <main_module> $SESSION-----BEGIN.*KEY-----2.3 Insufficient Key Sizes [*] (MASWE-0009)
2.4 IV Reuse [A] (MASWE-0022)
2.5 Key Reuse [*] (MASWE-0012)
2.6 Insecure Random [*] (MASWE-0027)
Runtime crypto monitoring (ask user first):
igf agent pin start crypto $SESSION
# wait for app interaction...
igf log crypto $DEVICE $BUNDLE --limit 100
igf agent pin stop crypto $SESSION
3.1 Cleartext Traffic [*] (MASWE-0050)
NSAllowsArbitraryLoads in app infoigf agent app manifest $SESSION — look for usesCleartextTraffic=true3.2 Insecure TLS [*] (MASWE-0050)
3.3 Certificate Validation [*] (MASWE-0052)
3.4 Certificate Pinning [*] (MASWE-0047)
Runtime HTTP monitoring (ask user first): Run the capture pin for the target platform:
igf agent pin start http $SESSION # Android HTTP/WebSocket capture
igf agent pin start nsurl $SESSION # iOS NSURLSession/WebSocket capture
igf agent pin start sslpinning $SESSION # Android TLS validation monitoring
# wait for app interaction...
igf history http $DEVICE $BUNDLE --limit 100 # Android
igf history nsurl $DEVICE $BUNDLE --limit 100 # iOS
igf agent pin stop http $SESSION
igf agent pin stop nsurl $SESSION
igf agent pin stop sslpinning $SESSION
Flag: plaintext requests, API keys in headers/URLs, sensitive data in transit
4.1 WebView Security [A] (MASWE-0069)
4.2 Exported Components [A]
igf agent android activities $SESSION
igf agent android services $SESSION
igf agent android receivers $SESSION
igf agent android providers $SESSION
Flag: exported without permission protection (INFO-MEDIUM), content providers queryable (test with igf agent android provider-query <uri> $SESSION)
4.3 Sensitive UI Data Exposure [*] (MASWE-0053)
4.4 Screenshot/Screen Capture Prevention [*] (MASWE-0055)
4.5 Notification Data [A] (MASWE-0054)
4.6 Deep Links / URL Schemes [I]
igf agent app urls $SESSION — check for custom schemes accepting external input5.1 Binary Protections [*] (MASWE-0116)
igf agent checksec main $SESSION
5.2 Dependencies [*] (MASWE-0076)
igf agent symbol modules $SESSION — identify third-party libraries5.3 Debugging Symbols [*] (MASWE-0093)
5.4 Platform Version [A] (MASWE-0077)
targetSdkVersion < 33 (MEDIUM)6.1 Debuggable [*] (MASWE-0067)
android:debuggable=true in manifest — igf agent app manifest $SESSIONget-task-allow entitlement — igf agent app entitlements $SESSION6.2 Code Signing [*] (MASWE-0104)
6.3 Root/Jailbreak Detection [*] (MASWE-0097)
igf agent class list $SESSION — search for root/jailbreak detection classes6.4 Device Lock [*] (MASWE-0008)
6.5 StrictMode [A] (MASWE-0094)
6.6 Obfuscation Indicators [*]
igf agent class list $SESSION — short/randomized names = ProGuard/R8igf agent symbol modules $SESSION — stripped symbols = obfuscation7.1 Dangerous Permissions [A] (MASWE-0117)
7.2 SDK Data Handling [*] (MASWE-0112)
7.3 PII in Network Traffic [A] (MASWE-0108)
Runtime privacy monitoring (ask user first):
igf agent pin start privacy $SESSION
# wait for app interaction...
igf history privacy $DEVICE $BUNDLE --limit 100
igf agent pin stop privacy $SESSION
Categorize: microphone, camera, photos, sensors, bluetooth, wifi, location, health
igf agent symbol modules $SESSION # find main module
igf agent symbol strings <main_module> $SESSION
Search for:
sk_, pk_, api_, key_, token_, AIza, AKIA, ghp_, glpat------BEGIN.*PRIVATE KEY-----://.*:.*@Also check:
igf agent ios userdefaults $SESSION for credential-like keysStop all active hooks:
igf agent pin list $SESSION
igf agent pin stop <id> $SESSION # for each active pin
igf agent hook status $SESSION
igf agent hook stop <group> $SESSION # for low-level hook groups, if used
igf agent lsof $SESSION
Flag unexpected network connections.
Write to file the user specifies (default: mastg-report.md).
# Security Audit Report: {bundle}
| Field | Value |
|-------|-------|
| **Date** | {YYYY-MM-DD} |
| **Platform** | {Android/iOS} |
| **Device** | {device} |
| **Bundle** | {bundle} |
| **Standard** | OWASP MASTG v2 |
## Executive Summary
| Severity | Count |
|----------|-------|
| Critical | N |
| High | N |
| Medium | N |
| Info | N |
| Positive | N |
> **Risk Assessment:** {one sentence}
## Findings
### MASVS-STORAGE
#### [!] {Finding Title}
**Severity:** HIGH | **MASTG:** MASTG-TEST-XXXX | **MASWE:** MASWE-XXXX
{Description}
**Evidence:**
{actual igf command output}
**Recommendation:** {fix}
### MASVS-CRYPTO
### MASVS-NETWORK
### MASVS-PLATFORM
### MASVS-CODE
### MASVS-RESILIENCE
### MASVS-PRIVACY
## Positive Findings
- [+] **{title}** — {description}
## Recommendations Summary
1. **[CRITICAL]** {rec}
2. **[HIGH]** {rec}
...