Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

mobile-code-review

Estrelas123

Forks13

Atualizado2 de junho de 2026 às 13:21

Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

OWASP

OWASP/secure-agent-playbook

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de garantia de qualidade de software e testadoresInformática e Matemática·SOC 15-1253

SKILL.md

readonly

name	mobile-code-review
description	Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.
license	CC-BY-4.0

Mobile Security Code Review

Review native Android and iOS source code for security vulnerabilities by following the full procedure in plays/mobile-code-review.md.

Steps

Scope & Context — Language (Java/Kotlin/Swift/Obj-C/Dart), platform, app type, sensitive data, exposure.
Platform Detection — Fingerprint Android (AndroidManifest.xml, build.gradle) and/or iOS (Info.plist, *.xcodeproj). If only a cross-platform shell is detected, declare partial coverage.
Systematic Review by MASVS Group — For each of the 8 MASVS groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) in priority order:
- Load data/masvs/MASVS-<GROUP>-<N>.md for the control statement and the mastg_tests: list.
- For each MASTG test ID, load data/mastg/MASTG-TEST-####.md and apply its Static Analysis content (V1) or Steps/Observation/Evaluation (V2) to the source tree.
- Note V1-fallback tests in findings using the file's status_note.
Diff-Specific Analysis (for PRs) — Focus on changed lines; verify pinning, permissions, and KeyStore/Keychain usage are not weakened.
Produce Findings — Use templates/finding.md. Sort by severity (CRITICAL > HIGH > MEDIUM > LOW > INFO). Deduplicate cross-group findings (cite the most specific MASVS control in OWASP Ref).

Output

Scope summary (platform, languages), upstream-pointer note for MASTG IDs (https://github.com/OWASP/mastg, https://mas.owasp.org/MASTG/), findings sorted by severity using templates/finding.md (each finding carries an optional MASTG references: bullet listing any non-TEST @MASTG-<KIND>-#### cross-refs cited in the informing tests, grouped by KIND alphabetically, IDs sorted numerically, omitted when empty), positive observations, severity count table, RESILIENCE static-only notice block, PRIVACY runtime-required caveat for findings against PRIVACY-2/PRIVACY-3, dynamic-test follow-up list (collected from data/mastg/ entries with type: [dynamic] that informed findings).

OWASP References

OWASP MASVS v2.1.0
OWASP MASTG (forward cross-references)
OWASP MAS Checklist
OWASP ASVS v5.0 (overlap items only)
CWE-312, CWE-327, CWE-295, CWE-926, CWE-749, others per finding

Mais deste repositório

mesmo repositório

agent-security-audit

OWASP/secure-agent-playbook

Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails. Use when reviewing CLAUDE.md files, MCP configs, agent orchestration code, or any AI agent setup.

2026-05-17123

agentic-ai-risk-assess

OWASP/secure-agent-playbook

Assess agentic AI applications against the OWASP Top 10 for Agentic Applications 2026. Use when reviewing autonomous AI agents, multi-agent systems, or agentic workflows for security risks including goal hijacking, tool misuse, privilege abuse, and rogue agent behavior.

2026-05-17123

llm-risk-assess

OWASP/secure-agent-playbook

Comprehensive LLM security assessment against OWASP Top 10 for LLM Applications 2025. Use when reviewing LLM-integrated applications, RAG pipelines, chatbots, AI agents, or GenAI features. Covers prompt injection, data poisoning, supply chain, excessive agency, and more with real-world attack scenarios and testing methodologies.

2026-05-17123

mcp-server-review

OWASP/secure-agent-playbook

Security review of MCP (Model Context Protocol) server implementations and configurations. Use when auditing MCP server source code, evaluating third-party MCP servers before installation, or reviewing Claude Code MCP integrations for overpermissioning, injection risks, and data exposure.

2026-05-17123

prompt-injection-test

OWASP/secure-agent-playbook

Test LLM-integrated applications against known prompt injection techniques, evasion methods, and attack intents using the Arcanum PI Taxonomy. Use when red-teaming AI apps, validating guardrails, or deepening LLM01 (Prompt Injection) assessments.

2026-05-17123

api-security-review

OWASP/secure-agent-playbook

Comprehensive API security review against OWASP API Security Top 10 (2023). Use when reviewing OpenAPI/Swagger specs, auditing REST/GraphQL/gRPC implementations, testing authentication mechanisms, or checking API gateway configurations. Covers BOLA/IDOR, broken auth, mass assignment, rate limiting, SSRF, and more with real-world attack scenarios.

2026-05-17123

Mobile Security Code Review

Review native Android and iOS source code for security vulnerabilities by following the full procedure in plays/mobile-code-review.md.

Steps

Scope & Context — Language (Java/Kotlin/Swift/Obj-C/Dart), platform, app type, sensitive data, exposure.

Platform Detection — Fingerprint Android (AndroidManifest.xml, build.gradle) and/or iOS (Info.plist, *.xcodeproj). If only a cross-platform shell is detected, declare partial coverage.

Systematic Review by MASVS Group — For each of the 8 MASVS groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) in priority order:

Load data/masvs/MASVS-<GROUP>-<N>.md for the control statement and the mastg_tests: list.
For each MASTG test ID, load data/mastg/MASTG-TEST-####.md and apply its Static Analysis content (V1) or Steps/Observation/Evaluation (V2) to the source tree.
Note V1-fallback tests in findings using the file's status_note.

Diff-Specific Analysis (for PRs) — Focus on changed lines; verify pinning, permissions, and KeyStore/Keychain usage are not weakened.

Produce Findings — Use templates/finding.md. Sort by severity (CRITICAL > HIGH > MEDIUM > LOW > INFO). Deduplicate cross-group findings (cite the most specific MASVS control in OWASP Ref).

Output

OWASP References

OWASP MASVS v2.1.0

OWASP MASTG (forward cross-references)

OWASP MAS Checklist

OWASP ASVS v5.0 (overlap items only)

CWE-312, CWE-327, CWE-295, CWE-926, CWE-749, others per finding