agentleFS
Sign inStart free
ashrafiucseashrafiucse/security-audit-skills/skills/mobile-security/SKILL.md

mobile-security

Skill2 starsChanged 49 days agoMITView on GitHub

Audits mobile app security — Android (AndroidManifest.xml: exported components, allowBackup, debuggable, cleartext traffic, network security config; WebView misconfigurations; hardcoded keys), iOS (Info.plist ATS exceptions, secrets in UserDefaults, keychain accessibility), and React Native/Flutter storage pitfalls. Use when the project contains AndroidManifest.xml, Info.plist, or Kotlin/Java/Swift/Dart/RN code.

6 other projects use a version of this.

Adopted by

Most recently taken up by

The file

Create a free account to mount
Files
SKILL.md

Mobile Security

Step 0 — Detect

rg --files -g 'AndroidManifest.xml' -g 'Info.plist' -g '*.kt' -g '*.java' -g '*.swift' -g '*.m' -g '*.dart' -g 'pubspec.yaml' -g 'Podfile' -g 'app/build.gradle*' | head

Step 1 — Android manifest

rg -n "android:exported|allowBackup|debuggable|usesCleartextTraffic|networkSecurityConfig|protectionLevel|grantUriPermissions" -g 'AndroidManifest.xml' -g '*.xml'

Component census (don't eyeball): enumerate exported components BY TYPE — agents reliably spot activities and providers while services/receivers get skipped. Four separate passes, one table row each:

rg -n "<activity[^>]*android:exported=\"true\"" -g 'AndroidManifest.xml'
rg -n "<service[^>]*android:exported=\"true\"" -g 'AndroidManifest.xml'
rg -n "<receiver[^>]*android:exported=\"true\"" -g 'AndroidManifest.xml'
rg -n "<provider[^>]*android:exported=\"true\"" -g 'AndroidManifest.xml'
FlagFindingSeverity
android:allowBackup="true" (or omitted — it's the default)data extractable via adb backupMedium
android:debuggable="true" in release manifestdebug bridge on prod devicesHigh
exported activity/service/receiver/provider without android:permissioncomponent hijacking — any app invokes itHigh
component with <intent-filter> and no explicit exportedfilters imply exported (API ≤30 rules)High
usesCleartextTraffic="true" / cleartextTrafficPermitted="true"HTTP downgrade/MITMMedium
custom permission protectionLevel="normal" guarding sensitive opsany app can request itMedium
exported provider + grantUriPermissionsURI grant to malicious appsHigh

Note: cleartext is blocked by default since API 28 — check minSdkVersion; below 28 without a network_security_config = de facto cleartext allowed.

Step 2 — Android code

rg -n "addJavascriptInterface|setJavaScriptEnabled|setAllowFileAccess|loadUrl|setAllowUniversalAccessFromFileURLs" -g '*.kt' -g '*.java'
rg -n -i "(api[_-]?key|secret|token)\s*=\s*[\"'][^\"']{8,}" -g '*.kt' -g '*.java' -g 'strings.xml' -g 'build.gradle*'
  • addJavascriptInterface + JS enabled → classic RCE bridge (High; Critical with file access + user URL)
  • loadUrl(intent.dataString) / loading http:// update URLs with JS on → High
  • Hardcoded keys in code/strings.xml/BuildConfig → Critical (decompiling is trivial)
  • sharedPreferences storing tokens unencrypted → Medium

Step 3 — iOS

rg -n "NSAllowsArbitraryLoads|NSAllowsLocalNetworking|NSExceptionDomains" -g 'Info.plist'
rg -n "UserDefaults|kSecAttrAccessible|Keychain" -g '*.swift' -g '*.m' | head -20
  • NSAllowsArbitraryLoads=true (ATS off) → Medium; NSExceptionDomains list → review each
  • Tokens/PII in UserDefaults (plist, unencrypted, included in backups) → Medium/High
  • Keychain items without kSecAttrAccessible...ThisDeviceOnly for sensitive items → Low/Medium
  • Hardcoded secrets in Swift/ObjC → Critical

Step 4 — Cross-platform

  • React Native: tokens in AsyncStorage (unencrypted) → Medium; dev deps (flipper, react-devtools-core) reachable in release builds → Medium
  • Flutter: tokens outside flutter_secure_storage → Medium; disabling certificate validation (badCertificateCallback => true) → High. Full Dart-side shapes (storage census, dio/adapter cert bypass, WebView channels, platform channels, deep-link routes, --dart-define secrets, Random()/md5): ../flutter-security/SKILL.md — this skill keeps the platform/manifest half
  • Kotlin/Java app-code shapes (EncryptedSharedPreferences, execSQL/rawQuery, TrustManager/HostnameVerifier bypass, @JavascriptInterface bodies, PendingIntent immutability, Keystore/ECB, logcat tokens, google-services.json): ../android-code-security/SKILL.md — this skill keeps the manifest half; the WebView-bridge greps above stop at existence, that skill opens the method bodies

Reporting

Manifest findings cite the XML line; code findings cite file:line. Fixes are usually one attribute (allowBackup="false", exported="false" + permission) — give the exact line. Cross-reference hardcoded keys with ../secrets-detection/SKILL.md for rotation guidance.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free