メニュー
Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In.
Deep audit of code quality and supply chain security against OWASP MASVS-CODE controls. Use when modifying libs.versions.toml dependencies, minSdk, R8/ProGuard rules, or input validation logic. This is the primary skill for Detekt-detectable issues.
Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain.
Generate a STRIDE threat model for Dividox mapped to MASVS controls with NowSecure risk tiering. Use when designing new features with a significant security surface, or for periodic threat reviews.
Deep audit of network communication security against OWASP MASVS-NETWORK controls. Use when code configures HTTP clients (Ktor, OkHttp), touches TLS, certificates, or network_security_config.xml.
Deep audit of platform interaction security against OWASP MASVS-PLATFORM controls. Use when code touches deep links, Intents, exported components, WebViews, or AndroidManifest/Info.plist.
| name | masvs-checklist |
| description | Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture. |
Context: See
.ai-context/security-instructions.mdfor Dividox security profile (Tier 2 fintech — all controls except RESILIENCE are required).
Generate a MASVS_CHECKLIST.md for the current state of the Dividox codebase, covering
all 8 MASVS v2 categories with per-control MASTG test mappings and compliance status.
For each category below, invoke the corresponding deep-audit skill to populate findings, then aggregate into the compliance matrix.
| Step | Action | Skill |
|---|---|---|
| 1 | Storage audit | skill: masvs-secure-storage-audit |
| 2 | Crypto audit | skill: masvs-crypto-review |
| 3 | Auth audit | skill: masvs-auth-assessment |
| 4 | Network audit | skill: masvs-network-security-check |
| 5 | Platform audit | skill: masvs-platform-interaction-review |
| 6 | Code quality audit | skill: masvs-code-quality-scan |
| 7 | Privacy audit | skill: masvs-privacy-audit |
| 8 | Resilience (optional) | skill: masvs-resilience-assessment |
MASVS_CHECKLIST.md# MASVS v2 Compliance Checklist — Dividox
**Date**: {date}
**App version**: {version}
**Tier**: 2 (Handles PII and Financial Data)
## Compliance Matrix
| Category | Control | Status | MASTG Test | Notes |
|----------|---------|--------|------------|-------|
| MASVS-STORAGE | STORAGE-1 | ✅ PASS / ⚠️ WARN / ❌ FAIL | MASTG-TEST-0001 | |
| MASVS-STORAGE | STORAGE-2 | | MASTG-TEST-0002 | |
| MASVS-CRYPTO | CRYPTO-1 | | MASTG-TEST-0013 | |
| MASVS-CRYPTO | CRYPTO-2 | | MASTG-TEST-0014 | |
| MASVS-AUTH | AUTH-1 | | MASTG-TEST-0068 | |
| MASVS-AUTH | AUTH-2 | | MASTG-TEST-0016 | |
| MASVS-AUTH | AUTH-3 | | MASTG-TEST-0018 | |
| MASVS-NETWORK | NETWORK-1 | | MASTG-TEST-0020 | |
| MASVS-NETWORK | NETWORK-2 | | MASTG-TEST-0022 | |
| MASVS-PLATFORM | PLATFORM-1 | | MASTG-TEST-0028 | |
| MASVS-PLATFORM | PLATFORM-2 | | MASTG-TEST-0031 | |
| MASVS-PLATFORM | PLATFORM-3 | | MASTG-TEST-0035 | |
| MASVS-CODE | CODE-1 | | MASTG-TEST-0041 | |
| MASVS-CODE | CODE-2 | | MASTG-TEST-0041 | |
| MASVS-CODE | CODE-3 | | MASTG-TEST-0039 | |
| MASVS-CODE | CODE-4 | | MASTG-TEST-0005 | |
| MASVS-PRIVACY | PRIVACY-1 | | MASTG-TEST-0005 | |
| MASVS-PRIVACY | PRIVACY-2 | | MASTG-TEST-0006 | |
| MASVS-PRIVACY | PRIVACY-3 | | MASTG-TEST-0057 | |
| MASVS-PRIVACY | PRIVACY-4 | | MASTG-TEST-0057 | |
## Summary
- ✅ PASS: {n}
- ⚠️ WARN: {n}
- ❌ FAIL: {n}
- Overall verdict: COMPLIANT / NON-COMPLIANT
## Remediation Roadmap (by priority)
1. [FAIL items — must fix before release]
2. [WARN items — fix within next sprint]
3. [Recommendations for Tier 3 upgrade]
This checklist is static analysis only. Dynamic testing (Frida instrumentation, proxy traffic inspection, device-level testing) is needed for full MASVS certification.