메뉴
Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In.
Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture.
Deep audit of code quality and supply chain security against OWASP MASVS-CODE controls. Use when modifying libs.versions.toml dependencies, minSdk, R8/ProGuard rules, or input validation logic. This is the primary skill for Detekt-detectable issues.
Generate a STRIDE threat model for Dividox mapped to MASVS controls with NowSecure risk tiering. Use when designing new features with a significant security surface, or for periodic threat reviews.
Deep audit of network communication security against OWASP MASVS-NETWORK controls. Use when code configures HTTP clients (Ktor, OkHttp), touches TLS, certificates, or network_security_config.xml.
Deep audit of platform interaction security against OWASP MASVS-PLATFORM controls. Use when code touches deep links, Intents, exported components, WebViews, or AndroidManifest/Info.plist.
| name | masvs-crypto-review |
| description | Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain. |
Context: See
.ai-context/security-instructions.mdfor when to invoke this skill and the full MASVS coverage map for Dividox.
| Control | Requirement |
|---|---|
| MASVS-CRYPTO-1 | App uses current, industry-standard cryptography |
| MASVS-CRYPTO-2 | Cryptographic keys managed securely throughout their lifecycle |
| Algorithm | Issue |
|---|---|
| DES, 3DES | Broken |
| RC4 | Broken |
| MD5, SHA-1 (security use) | Collision-prone |
| RSA < 2048-bit | Insufficient key length |
java.util.Random | Not cryptographically secure |
| ECB mode (any cipher) | Deterministic, pattern-leaking |
| Algorithm | Notes |
|---|---|
| AES-256-GCM | Preferred for symmetric encryption |
| AES-256-CBC + HMAC-SHA256 | Acceptable with random IV |
| ChaCha20-Poly1305 | Good for KMP/mobile |
| RSA ≥ 2048-bit with OAEP | For key wrapping |
| SHA-256 / SHA-512 | General hashing |
| Argon2id / bcrypt / scrypt | Password hashing |
SecureRandom | Required for all random bytes |
Dividox uses cryptography for:
EncryptedSharedPreferences)androidMain)KeyGenParameterSpec must specify purpose (ENCRYPT|DECRYPT or SIGN|VERIFY).ECB.setRandomizedEncryptionRequired(true) must be set (enforces random IV).iosMain)kSecAttrAccessibleWhenUnlockedThisDeviceOnly.CryptoKit preferred over legacy CommonCrypto.SecKey operations must use OAEP for RSA.commonMain)kotlinx-crypto or platform-specific expects must use algorithms from the acceptable list.Cipher, KeyGenerator, MessageDigest, SecretKey, CryptoKit, SecKey, AES, RSA, SHA.KeyGenParameterSpec (Android) or SecKeyGenerateSymmetric (iOS)."key", "secret", "iv" literals.## MASVS-CRYPTO Audit Report
### Cryptographic Inventory
| Location | Algorithm | Mode | Key size | Storage | Status |
|----------|-----------|------|----------|---------|--------|
### CRYPTO-1 — Standard Algorithms
- [FAIL/WARN/PASS] {finding} — {file}:{line}
### CRYPTO-2 — Key Management
- [FAIL/WARN/PASS] {finding} — {file}:{line}
### Summary
- FAIL: {n} | WARN: {n} | PASS: {n}
- Verdict: APPROVED / BLOCKED