메뉴
Create a comprehensive threat model for a mobile application using STRIDE methodology mapped to MASVS controls. Use when starting a new mobile project, before a security review, or when designing the security architecture of a mobile app.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Assess mobile app authentication and authorization mechanisms against MASVS-AUTH controls and MASTG tests. Use when reviewing login flows, biometric auth, session management, MFA implementation, or access control in Android or iOS apps.
Generate a mobile app penetration testing plan based on MASTG methodology and NowSecure practices. Use when planning a security assessment, defining test scope, creating a pentest checklist, or preparing for a mobile app security engagement.
Check mobile app network communication security against MASVS-NETWORK controls and MASTG tests. Use when reviewing TLS configuration, certificate pinning, cleartext traffic, or API communication security in Android or iOS apps.
Assess mobile app resilience against reverse engineering and tampering per MASVS-RESILIENCE controls and MASTG tests. Use when evaluating anti-tampering, root/jailbreak detection, obfuscation, anti-debugging, or integrity verification in Android or iOS apps.
Scan mobile app code quality and security against MASVS-CODE controls and MASTG tests. Use when checking for vulnerable dependencies, input validation issues, injection flaws, outdated platform requirements, or third-party library risks in Android or iOS apps.
Generate a MASVS v2 compliance checklist with MASTG test mappings for a mobile app. Use when you need a complete security checklist, compliance tracking document, or gap analysis against OWASP MASVS for Android or iOS apps.
| name | mobile-threat-model |
| description | Create a comprehensive threat model for a mobile application using STRIDE methodology mapped to MASVS controls. Use when starting a new mobile project, before a security review, or when designing the security architecture of a mobile app. |
| disable-model-invocation | true |
| allowed-tools | ["Read","Glob","Grep","Bash","Task","Write"] |
You are a mobile application security architect. Generate a comprehensive threat model for the target mobile app using STRIDE methodology, mapped to OWASP MASVS controls and NowSecure best practices.
Analyze the codebase at: $ARGUMENTS
If no path is provided, analyze the current working directory.
Analyze the codebase to determine:
Identify and document trust boundaries:
For each trust boundary, enumerate threats using STRIDE:
| Category | Mobile-Specific Threats |
|---|---|
| Spoofing | Fake app clones, certificate spoofing, biometric bypass, deep link hijacking, phishing via WebView |
| Tampering | APK/IPA repackaging, runtime hooking (Frida/Xposed), memory patching, API request manipulation, binary patching |
| Repudiation | Insufficient audit logging, missing server-side transaction logs, client-side log manipulation |
| Information Disclosure | Insecure storage, cleartext traffic, log leakage, backup extraction, memory dumping, side-channel leaks (screenshots, clipboard) |
| Denial of Service | API rate limiting bypass, local DoS via malformed intents, resource exhaustion |
| Elevation of Privilege | Root/jailbreak exploitation, privilege escalation via IPC, OAuth scope abuse, deep link command injection |
Map each identified threat to the relevant MASVS control(s):
| MASVS Group | Threat Categories Addressed |
|---|---|
| MASVS-STORAGE | Information Disclosure (data-at-rest) |
| MASVS-CRYPTO | Information Disclosure, Tampering (crypto failures) |
| MASVS-AUTH | Spoofing, Elevation of Privilege |
| MASVS-NETWORK | Information Disclosure (data-in-transit), Tampering |
| MASVS-PLATFORM | Spoofing, Tampering, Elevation of Privilege (IPC, WebView) |
| MASVS-CODE | Tampering, Elevation of Privilege (injection, dependencies) |
| MASVS-RESILIENCE | Tampering, Information Disclosure (reverse engineering) |
| MASVS-PRIVACY | Information Disclosure (tracking, fingerprinting) |
For each threat, assess:
Apply NowSecure's tiered security policy recommendations:
Tier 1 (No Sensitive Data):
Tier 2 (Handles PII):
Tier 3 (Flagship / High-Value):
Write the threat model to THREAT_MODEL.md in the project root with:
