javiercamarenatriguero

Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In.

Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture.

Deep audit of code quality and supply chain security against OWASP MASVS-CODE controls. Use when modifying libs.versions.toml dependencies, minSdk, R8/ProGuard rules, or input validation logic. This is the primary skill for Detekt-detectable issues.

Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain.

Generate a STRIDE threat model for Dividox mapped to MASVS controls with NowSecure risk tiering. Use when designing new features with a significant security surface, or for periodic threat reviews.

Deep audit of network communication security against OWASP MASVS-NETWORK controls. Use when code configures HTTP clients (Ktor, OkHttp), touches TLS, certificates, or network_security_config.xml.

Deep audit of platform interaction security against OWASP MASVS-PLATFORM controls. Use when code touches deep links, Intents, exported components, WebViews, or AndroidManifest/Info.plist.

Deep audit of privacy controls against OWASP MASVS-PRIVACY controls. Use when code touches permissions, analytics SDKs, user identifiers, consent flows, or data export/deletion.

Designs and enforces a clean multi-module Android architecture with strict layer isolation. Use when user asks "where should this code go", "create a new module", "fix a circular dependency", "what layer does this belong in", or "set up module architecture".

Architects Android runtime permissions across multi-module projects following Clean Architecture. Use when user asks to "request a permission", "handle runtime permission", "camera permission", "location permission", or "structure permissions in Clean Architecture".

Writes unit tests for Android Kotlin code covering ViewModels, Use Cases, and Repositories using MockK and Kotlin Coroutines Test. Use when user asks to "write a unit test", "add tests for this class", "how do I test a ViewModel", or "apply GIVEN/WHEN/THEN".

Writes idiomatic, maintainable, and accessible Jetpack Compose UI. Use when user asks to "create a composable", "write a Compose screen", "build a UI component", "review Compose code", or "refactor XML to Compose".

Implements type-safe navigation using Jetpack Navigation 3 (Nav3) with Compose. Use when user asks to "add a new screen", "wire navigation", "pass results between screens", "set up Nav3", or "navigate to a destination". Covers NavKey routes, NavDisplay, navigator abstractions, and ResultStore.

Audits and fixes Jetpack Compose runtime performance issues. Use when user says "Compose is slow", "too many recompositions", "janky scrolling", "frame drops", or asks to "optimize Compose UI". Performs code-first review and guides profiling when needed.

Creates and maintains GitHub Actions CI/CD workflows for Android projects. Use when user asks to "set up CI", "create a GitHub Action", "add a CI pipeline", "configure GitHub Actions for Android", or "optimize build times".

Configures Gradle builds for Android using Version Catalogs and Kotlin DSL. Use when user asks to "add a dependency", "configure Gradle", "update a library version", "set up a version catalog", or "resolve a build conflict".