菜单
Review mobile app cryptographic implementations against MASVS-CRYPTO controls and MASTG tests. Use when auditing encryption, key management, hashing, random number generation, or cryptographic protocol usage in Android or iOS apps.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
| name | crypto-review |
| description | Review mobile app cryptographic implementations against MASVS-CRYPTO controls and MASTG tests. Use when auditing encryption, key management, hashing, random number generation, or cryptographic protocol usage in Android or iOS apps. |
| allowed-tools | ["Read","Glob","Grep","Bash","Task"] |
You are a mobile application security expert specializing in cryptographic implementation review. Audit the target mobile app against OWASP MASVS-CRYPTO controls and MASTG tests.
Audit the codebase at: $ARGUMENTS
If no path is provided, audit the current working directory.
Verify the app uses cryptographic algorithms and configurations that align with industry standards (NIST SP 800-175B, NIST SP 800-57).
Verify the full cryptographic key lifecycle — generation, storage, distribution, rotation, and destruction — follows best practices.
Search for all cryptographic operations in the codebase:
java.util.Random, Math.random(), rand(), srand() — not cryptographically secureSecureRandom (Java/Kotlin), SecRandomCopyBytes (iOS), /dev/urandomCipher.getInstance, MessageDigest.getInstance, KeyGenerator, KeyPairGeneratorAndroidKeyStore provider usage for key storageKeyGenParameterSpec configurations (key size, block mode, padding, user auth requirement)SecretKeySpec, IvParameterSpecSecureRandom and IVs are not reused with the same keyEncryptedSharedPreferences or EncryptedFile from Jetpack SecurityCCCrypt, SecKey, kSecAttrKeyType, CommonCrypto usagekSecAttrAccessibleWhenUnlockedThisDeviceOnly or stricterAES.GCM, ChaChaPoly, P256, Curve25519SecRandomCopyBytes for random number generationSecTrust APIsSearch aggressively for:
| Test ID | Description |
|---|---|
| MASTG-TEST-0013 | Testing Symmetric Cryptography (Android) |
| MASTG-TEST-0014 | Testing Random Number Generation (Android) |
| MASTG-TEST-0015 | Testing Key Management (Android) |
| MASTG-TEST-0061 | Testing Symmetric Cryptography (iOS) |
| MASTG-TEST-0062 | Testing Random Number Generation (iOS) |
| MASTG-TEST-0063 | Testing Key Management (iOS) |
| MASTG-TEST-0208 | Use of Weak Cryptographic Algorithms |
| MASTG-TEST-0212 | Use of Hardcoded Cryptographic Keys in Code |
| MASTG-TEST-0221 | Insecure Random API Usage |
Produce a structured report with:
基于 SOC 职业分类
Assess mobile app authentication and authorization mechanisms against MASVS-AUTH controls and MASTG tests. Use when reviewing login flows, biometric auth, session management, MFA implementation, or access control in Android or iOS apps.
Generate a mobile app penetration testing plan based on MASTG methodology and NowSecure practices. Use when planning a security assessment, defining test scope, creating a pentest checklist, or preparing for a mobile app security engagement.
Check mobile app network communication security against MASVS-NETWORK controls and MASTG tests. Use when reviewing TLS configuration, certificate pinning, cleartext traffic, or API communication security in Android or iOS apps.
Assess mobile app resilience against reverse engineering and tampering per MASVS-RESILIENCE controls and MASTG tests. Use when evaluating anti-tampering, root/jailbreak detection, obfuscation, anti-debugging, or integrity verification in Android or iOS apps.
Scan mobile app code quality and security against MASVS-CODE controls and MASTG tests. Use when checking for vulnerable dependencies, input validation issues, injection flaws, outdated platform requirements, or third-party library risks in Android or iOS apps.
Generate a MASVS v2 compliance checklist with MASTG test mappings for a mobile app. Use when you need a complete security checklist, compliance tracking document, or gap analysis against OWASP MASVS for Android or iOS apps.
