菜单
Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate a full OWASP MASVS v2 compliance checklist for Dividox with MASTG test mappings. Use before a release, for a compliance review, or when assessing overall security posture.
Deep audit of code quality and supply chain security against OWASP MASVS-CODE controls. Use when modifying libs.versions.toml dependencies, minSdk, R8/ProGuard rules, or input validation logic. This is the primary skill for Detekt-detectable issues.
Deep audit of cryptographic implementations against OWASP MASVS-CRYPTO controls. Use when code generates keys, encrypts/decrypts data, uses hashing, or touches AndroidKeyStore / iOS Keychain.
Generate a STRIDE threat model for Dividox mapped to MASVS controls with NowSecure risk tiering. Use when designing new features with a significant security surface, or for periodic threat reviews.
Deep audit of network communication security against OWASP MASVS-NETWORK controls. Use when code configures HTTP clients (Ktor, OkHttp), touches TLS, certificates, or network_security_config.xml.
Deep audit of platform interaction security against OWASP MASVS-PLATFORM controls. Use when code touches deep links, Intents, exported components, WebViews, or AndroidManifest/Info.plist.
| name | masvs-auth-assessment |
| description | Deep audit of authentication and session management against OWASP MASVS-AUTH controls. Use when code touches login, logout, token storage, token refresh, biometrics, or Google Sign-In. |
Context: See
.ai-context/security-instructions.mdfor when to invoke this skill and the full MASVS coverage map for Dividox.
| Control | Requirement |
|---|---|
| MASVS-AUTH-1 | Remote authentication follows current best practices |
| MASVS-AUTH-2 | Sensitive local operations protected by local authentication |
| MASVS-AUTH-3 | App enforces step-up authentication for sensitive actions |
| Check | Expected |
|---|---|
| OAuth 2.0 PKCE used for authorization code flow | ✅ |
state parameter validated to prevent CSRF | ✅ |
nonce included and validated for OIDC | ✅ |
| ID token validated (signature, expiry, audience) | ✅ |
| Refresh token stored in Keystore/Keychain, not SharedPreferences | ✅ |
| Refresh token rotation on each use | ✅ |
| Token expiry respected — no indefinite sessions | ✅ |
| Logout clears ALL tokens (local + server-side revocation) | ✅ |
| Check | Expected |
|---|---|
Biometric uses BiometricPrompt (Android) / LAContext (iOS) | ✅ |
| Biometric result bound to a Keystore-protected key operation | ✅ |
| No custom biometric implementations | ✅ |
| No biometric bypass via backup PIN/password that skips key unwrap | ⚠️ Warn |
| Check | Expected |
|---|---|
| Delete account requires re-authentication | ✅ |
| Export portfolio requires re-authentication | ✅ |
| Step-up triggers fresh auth (not just PIN check) | ✅ |
GoogleSignIn / FirebaseAuth call to token persistence.SharedPreferences, DataStore, UserDefaults for any token key.BiometricPrompt/LAContext usage.## MASVS-AUTH Audit Report
### AUTH-1 — Remote Authentication
- [FAIL/WARN/PASS] {finding} — {file}:{line}
### AUTH-2 — Local Authentication
- [FAIL/WARN/PASS] {finding} — {file}:{line}
### AUTH-3 — Step-Up Authentication
- [FAIL/WARN/PASS] {finding} — {file}:{line}
### Summary
- FAIL: {n} | WARN: {n} | PASS: {n}
- Verdict: APPROVED / BLOCKED