Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

mobile-code-review

Étoiles123

Forks13

Mis à jour2 juin 2026 à 13:21

Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

OWASP

OWASP/secure-agent-playbook

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en assurance qualité des logiciels et testeursProfessions informatiques et mathématiques·SOC 15-1253

SKILL.md

readonly

name	mobile-code-review
description	Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.
license	CC-BY-4.0

Mobile Security Code Review

Review native Android and iOS source code for security vulnerabilities by following the full procedure in plays/mobile-code-review.md.

Steps

Scope & Context — Language (Java/Kotlin/Swift/Obj-C/Dart), platform, app type, sensitive data, exposure.
Platform Detection — Fingerprint Android (AndroidManifest.xml, build.gradle) and/or iOS (Info.plist, *.xcodeproj). If only a cross-platform shell is detected, declare partial coverage.
Systematic Review by MASVS Group — For each of the 8 MASVS groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) in priority order:
- Load data/masvs/MASVS-<GROUP>-<N>.md for the control statement and the mastg_tests: list.
- For each MASTG test ID, load data/mastg/MASTG-TEST-####.md and apply its Static Analysis content (V1) or Steps/Observation/Evaluation (V2) to the source tree.
- Note V1-fallback tests in findings using the file's status_note.
Diff-Specific Analysis (for PRs) — Focus on changed lines; verify pinning, permissions, and KeyStore/Keychain usage are not weakened.
Produce Findings — Use templates/finding.md. Sort by severity (CRITICAL > HIGH > MEDIUM > LOW > INFO). Deduplicate cross-group findings (cite the most specific MASVS control in OWASP Ref).

Output

Scope summary (platform, languages), upstream-pointer note for MASTG IDs (https://github.com/OWASP/mastg, https://mas.owasp.org/MASTG/), findings sorted by severity using templates/finding.md (each finding carries an optional MASTG references: bullet listing any non-TEST @MASTG-<KIND>-#### cross-refs cited in the informing tests, grouped by KIND alphabetically, IDs sorted numerically, omitted when empty), positive observations, severity count table, RESILIENCE static-only notice block, PRIVACY runtime-required caveat for findings against PRIVACY-2/PRIVACY-3, dynamic-test follow-up list (collected from data/mastg/ entries with type: [dynamic] that informed findings).

OWASP References

OWASP MASVS v2.1.0
OWASP MASTG (forward cross-references)
OWASP MAS Checklist
OWASP ASVS v5.0 (overlap items only)
CWE-312, CWE-327, CWE-295, CWE-926, CWE-749, others per finding

Plus depuis ce dépôt

même dépôt

agent-security-audit

OWASP/secure-agent-playbook

Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails. Use when reviewing CLAUDE.md files, MCP configs, agent orchestration code, or any AI agent setup.

2026-05-17123

agentic-ai-risk-assess

OWASP/secure-agent-playbook

Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026. Use when reviewing autonomous AI agents, multi-agent systems, or agentic workflows for security risks including goal hijacking, tool misuse, privilege abuse, and rogue agent behavior.

2026-05-17123

llm-risk-assess

OWASP/secure-agent-playbook

Comprehensive LLM security assessment against OWASP Top 10 for LLM Applications 2025. Use when reviewing LLM-integrated applications, RAG pipelines, chatbots, AI agents, or GenAI features. Covers prompt injection, data poisoning, supply chain, excessive agency, and more with real-world attack scenarios and testing methodologies.

2026-05-17123

mcp-server-review

OWASP/secure-agent-playbook

Security review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.

2026-05-17123

prompt-injection-test

OWASP/secure-agent-playbook

Test LLM-integrated applications against known prompt injection techniques, evasion methods, and attack intents using the Arcanum PI Taxonomy. Use when red-teaming AI apps, validating guardrails, or deepening LLM01 (Prompt Injection) assessments.

2026-05-17123

api-security-review

OWASP/secure-agent-playbook

Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.

2026-05-17123

Mobile Security Code Review

Review native Android and iOS source code for security vulnerabilities by following the full procedure in plays/mobile-code-review.md.

Steps

Scope & Context — Language (Java/Kotlin/Swift/Obj-C/Dart), platform, app type, sensitive data, exposure.

Platform Detection — Fingerprint Android (AndroidManifest.xml, build.gradle) and/or iOS (Info.plist, *.xcodeproj). If only a cross-platform shell is detected, declare partial coverage.

Systematic Review by MASVS Group — For each of the 8 MASVS groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) in priority order:

Load data/masvs/MASVS-<GROUP>-<N>.md for the control statement and the mastg_tests: list.
For each MASTG test ID, load data/mastg/MASTG-TEST-####.md and apply its Static Analysis content (V1) or Steps/Observation/Evaluation (V2) to the source tree.
Note V1-fallback tests in findings using the file's status_note.

Diff-Specific Analysis (for PRs) — Focus on changed lines; verify pinning, permissions, and KeyStore/Keychain usage are not weakened.

Produce Findings — Use templates/finding.md. Sort by severity (CRITICAL > HIGH > MEDIUM > LOW > INFO). Deduplicate cross-group findings (cite the most specific MASVS control in OWASP Ref).

Output

OWASP References

OWASP MASVS v2.1.0

OWASP MASTG (forward cross-references)

OWASP MAS Checklist

OWASP ASVS v5.0 (overlap items only)

CWE-312, CWE-327, CWE-295, CWE-926, CWE-749, others per finding