agentleFS
Sign inStart free
liuyi0808liuyi0808/android-review/skills/security-audit/SKILL.md

security-audit

Skill17 starsChanged 9 months agoMITView on GitHub

Android application security audit based on OWASP MASVS v2.0 and Kotlin secure coding practices. Use when: writing or reviewing code involving sensitive data storage (SharedPreferences, Room), cryptography (encryption keys, Keystore), authentication (biometrics, token management), network security (TLS, cert pinning), WebView hardening, Content Provider security, reverse engineering resilience (root detection, tamper detection), or user privacy (data minimization, consent).

192 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use create-stories, story-done and 10 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • lilangMaxSkill

    create-stories

    Break a single epic into implementable story files. Reads the epic, its GDD, governing ADRs, and control manifest. Each story embeds its GDD requirement TR-ID, ADR guidance, acceptance criteria, story type, and test evidence path. Run after /create-epics for each epic.

    Also in 11 projects that use this

  • lilangMaxSkill

    story-done

    End-of-story completion review. Reads the story file, verifies each acceptance criterion against the implementation, checks for GDD/ADR deviations, prompts code review, updates story status to Complete, and surfaces the next ready story from the sprint.

    Also in 11 projects that use this

  • nicepkgSkill

    community-led-growth

    Expert in community-led growth (CLG) - leveraging user communities to drive acquisition, retention, and expansion. Covers building developer communities, user groups, ambassador programs, and turning customers into advocates. Knows the difference between community as a feature vs community as a growth engine, and how to measure community ROI. Use when "community-led, CLG, ambassador program, champion program, user community, developer community, word of mouth, user group, " mentioned.

    Also in 5 projects that use this

  • nicepkgSkill

    ph-community-outreach

    Engage Reddit, Indie Hackers, Hacker News and other communities for Product Hunt launches. Use this skill to identify relevant communities, craft appropriate posts, and drive cross-platform engagement without appearing spammy.

    Also in 5 projects that use this

  • +7 more from lilangMax
  • +1 more from nicepkg

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 173 edited versions we read keep these.

  • 1

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    No Integrity Verification: - No signature check, root detection, or Play Integrity.

    line 83

“Common” is measured: kept by at least 6 in 10 of the 173 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Android Security Audit Skill (OWASP MASVS v2.0)

Comprehensive security audit guidance covering all 8 MASVS categories with Kotlin code examples, anti-patterns, and actionable checklists.

Reference: OWASP MASVS v2.0

Audit Output Format

Report findings using this template:

### [SEVERITY] Finding Title

**Category**: MASVS-STORAGE | CRYPTO | AUTH | NETWORK | PLATFORM | CODE | RESILIENCE | PRIVACY
**Severity**: CRITICAL | HIGH | MEDIUM | LOW | INFO
**File**: path/to/file.kt:LineNumber
**CWE**: CWE-XXX

**Description**: What the vulnerability is and why it matters.
**Evidence**:
```kotlin
// Vulnerable code snippet

Impact: What an attacker could achieve. Remediation:

// Fixed code

References: OWASP MASVS-XXXX, MSTG-XXXX-XXX


| Severity | Definition | Example |
|---|---|---|
| **CRITICAL** | Immediate exploitation, data breach likely | Hardcoded API keys, disabled TLS |
| **HIGH** | Exploitation feasible, significant impact | Missing pinning, plaintext storage |
| **MEDIUM** | Requires conditions, moderate impact | Missing root detection, verbose logs |
| **LOW** | Minor improvement, limited impact | Missing `FLAG_SECURE` |
| **INFO** | Best practice recommendation | Code style |

---

## Reference Guide — Load on Demand

Each reference file contains Bad/Good code examples, anti-pattern tables, and detailed checklists. **Read the relevant file when auditing that category.**

| # | Reference File | MASVS Category | When to Load |
|---|---------------|----------------|-------------|
| 1 | [references/storage.md](references/storage.md) | MASVS-STORAGE | SharedPreferences, file storage, backups, logs |
| 2 | [references/crypto.md](references/crypto.md) | MASVS-CRYPTO | Encryption keys, Keystore, algorithms, IVs |
| 3 | [references/auth.md](references/auth.md) | MASVS-AUTH | Biometrics, tokens, session management |
| 4 | [references/network.md](references/network.md) | MASVS-NETWORK | TLS, cert pinning, cleartext traffic |
| 5 | [references/platform.md](references/platform.md) | MASVS-PLATFORM | Intents, WebView, Content Providers |
| 6 | [references/code.md](references/code.md) | MASVS-CODE | Build config, R8, logging, debug artifacts |
| 7 | [references/resilience.md](references/resilience.md) | MASVS-RESILIENCE | Root detection, tamper detection, obfuscation |
| 8 | [references/privacy.md](references/privacy.md) | MASVS-PRIVACY | Data minimization, consent, GDPR/CCPA |

---

## 10 Common Android Security Anti-Patterns

1. **Hardcoded Secrets** - API keys/tokens in source or `strings.xml`. Extractable via `jadx`.
2. **Disabled Certificate Validation** - Custom `TrustManager`/`HostnameVerifier` accepting all. MITM.
3. **Plaintext Data Storage** - Tokens/PII in unencrypted SharedPreferences/SQLite/external storage.
4. **Exported Components Without Protection** - `exported="true"` without permissions. Any app can invoke.
5. **Insecure WebView** - `allowFileAccessFromFileURLs` + untrusted URLs. Local file theft, XSS.
6. **Biometric Bypass (No CryptoObject)** - Callback-only auth bypassable via Frida.
7. **Logging Sensitive Data** - `Log.d()` with tokens/PII in production. Readable via `adb logcat`.
8. **Deprecated Crypto** - MD5, DES, ECB, `java.util.Random`. Known practical attacks.
9. **Implicit Broadcasts with Sensitive Data** - Any app can intercept. Use explicit intents.
10. **No Integrity Verification** - No signature check, root detection, or Play Integrity. Trivial repackaging.

---

## Summary Checklist

### MASVS-STORAGE (7 items)
- [ ] S1: No plaintext passwords/tokens in SharedPreferences
- [ ] S2: EncryptedSharedPreferences for sensitive data
- [ ] S3: EncryptedFile for sensitive files; no external storage
- [ ] S4: No sensitive data in logs, clipboard, or backups
- [ ] S5: `allowBackup="false"` and `FLAG_SECURE` on sensitive screens
- [ ] S6: Database encryption for sensitive records
- [ ] S7: Keyboard suggestions disabled on sensitive fields

### MASVS-CRYPTO (6 items)
- [ ] C1: No hardcoded encryption keys, IVs, or salts
- [ ] C2: AES-256-GCM; keys in Android Keystore
- [ ] C3: RSA >= 2048; no MD5/SHA-1/DES/3DES/RC4
- [ ] C4: Unique IV per operation; `SecureRandom` only
- [ ] C5: PBKDF2/Argon2/scrypt for key derivation
- [ ] C6: No keys in `strings.xml` or `BuildConfig`

### MASVS-AUTH (6 items)
- [ ] A1: Biometric uses CryptoObject; BIOMETRIC_STRONG required
- [ ] A2: Short-lived access tokens (15-60 min)
- [ ] A3: Refresh tokens encrypted and rotated
- [ ] A4: Session invalidated on logout
- [ ] A5: Failed login rate limiting
- [ ] A6: Password fields disable autocomplete

### MASVS-NETWORK (6 items)
- [ ] N1: `cleartextTrafficPermitted="false"`
- [ ] N2: Certificate pinning with backup pins
- [ ] N3: No custom TrustManager/HostnameVerifier bypasses
- [ ] N4: TLS 1.2+ enforced
- [ ] N5: No sensitive data in URL parameters
- [ ] N6: API keys in headers, not URLs

### MASVS-PLATFORM (7 items)
- [ ] P1: Exported components have permissions or validation
- [ ] P2: Intent extras validated (type, range, allowlist)
- [ ] P3: PendingIntent uses FLAG_IMMUTABLE
- [ ] P4: Content Providers unexported; parameterized queries
- [ ] P5: WebView file access disabled; domain-restricted
- [ ] P6: `@JavascriptInterface` input validated
- [ ] P7: No implicit broadcasts with sensitive data

### MASVS-CODE (7 items)
- [ ] Q1: R8/ProGuard and resource shrinking enabled
- [ ] Q2: `isDebuggable = false` for release
- [ ] Q3: No `Log.d()`/`Log.v()` without `BuildConfig.DEBUG` guard
- [ ] Q4: No test code in release APK
- [ ] Q5: Dependency vulnerability scanning configured
- [ ] Q6: StrictMode in debug only
- [ ] Q7: Stack traces not exposed to users

### MASVS-RESILIENCE (6 items)
- [ ] R1: Multi-signal root detection
- [ ] R2: Debugger detection on sensitive operations
- [ ] R3: Runtime APK signature verification
- [ ] R4: Play Integrity API integrated
- [ ] R5: Code obfuscation and string encryption
- [ ] R6: Frida/Xposed and emulator detection

### MASVS-PRIVACY (6 items)
- [ ] V1: Data minimization enforced
- [ ] V2: Granular consent before collection
- [ ] V3: Purpose limitation enforced
- [ ] V4: Full data deletion supported (GDPR/CCPA)
- [ ] V5: No device identifiers without consent
- [ ] V6: Third-party SDKs audited; privacy policy in-app

**Total: 51 checklist items across 8 MASVS categories.**

---

## References

- [OWASP MASVS v2.0](https://mas.owasp.org/MASVS/)
- [OWASP MASTG](https://mas.owasp.org/MASTG/)
- [Android Security Best Practices](https://developer.android.com/privacy-and-security/security-tips)
- [Android Keystore System](https://developer.android.com/privacy-and-security/keystore)
- [Network Security Configuration](https://developer.android.com/privacy-and-security/security-config)
- [BiometricPrompt](https://developer.android.com/identity/sign-in/biometric-auth)
- [Play Integrity API](https://developer.android.com/google/play/integrity)

---

*Security is not a feature you bolt on at the end. It is a property of the system designed in from day one. Every line handling sensitive data, network communication, or platform interaction is an attack surface. Treat it accordingly.*

*For Google Play policy compliance, see the `play-store` skill.*

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free