almasumdev/awesome-mobile-security-agent-skills

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Biometric authentication on mobile using BiometricPrompt and LAContext, with keys cryptographically gated by user biometry. Use when adding unlock, re-auth, or step-up auth flows.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Multi-factor authentication on mobile — TOTP, push-based MFA, and recovery UX. Use when adding or reviewing a second factor.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

OAuth 2.1 + PKCE for native mobile apps. Covers redirect URIs, AppAuth libraries, and the flows that are safe vs deprecated. Use when implementing or reviewing user login.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Handling access and refresh tokens on mobile — storage, rotation, revocation, and expiration. Use when wiring up the authenticated HTTP layer.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Anti-tampering on mobile — signature checks, runtime application self-protection (RASP), and realistic return on investment. Use to decide which integrity controls are worth shipping.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Code obfuscation on mobile — R8 / ProGuard on Android, SwiftShield and its limitations on iOS, and realistic expectations. Use when hardening release builds.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Detecting rooted Android and jailbroken iOS devices as a risk signal — not a silver bullet. Use when deciding which operations to allow on a compromised device.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

GDPR on mobile — lawful basis per processing purpose, Data Subject Access Requests (DSAR), and deletion workflows. Use when shipping in the EEA / UK or any GDPR-aligned jurisdiction.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Device attestation and anti-abuse on mobile APIs using App Attest, DeviceCheck, and Google Play Integrity. Use to make "is this a real app on a real device" decisions server-side.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Preventing man-in-the-middle attacks on mobile — user CA posture on newer Android and iOS, cleartext traffic policies, and platform configuration. Use when configuring the app's network security baseline.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

TLS certificate pinning on mobile — pin sets, backup pins, kill switch, and library-specific wiring for OkHttp, URLSession, Dio, and TrustKit. Use when hardening the network layer.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Platform consent frameworks on mobile — iOS App Tracking Transparency (ATT) and Android User Messaging Platform (UMP) for GDPR / CCPA. Use when integrating analytics, ads, or any cross-app tracking.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Privacy-by-design principles on mobile — data minimization, purpose binding, consent. Use when introducing new data collection or third-party SDKs.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Keeping build-time secrets out of the repository — gitleaks, .gitignore discipline, and scoped CI credentials. Use when wiring up signing, store deploys, or CI secrets.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Handling secrets for mobile clients — why the client should not hold secrets, how to use a config server, and how App Check / Play Integrity replace API keys. Use when adding third-party SDKs or new server endpoints.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Encrypting local databases on mobile with SQLCipher, Room + EncryptedFile, or Realm encryption. Use when persisting structured sensitive data on device.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Using the Android Keystore (StrongBox / TEE) and iOS Keychain / Secure Enclave for hardware-backed keys, including biometric-gated keys. Use when generating or using long-lived cryptographic keys on device.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Cross-platform secure storage on mobile. Covers Android EncryptedSharedPreferences / Tink, iOS Keychain, fluttersecurestorage, and react-native-keychain. Use when persisting tokens, credentials, or PII on device.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Scanning mobile app dependencies for known vulnerabilities — Gradle Versions, Snyk, Dependabot, CocoaPods Audit, and npm audit. Use to keep the dependency surface patched.

almasumdev/awesome-mobile-security-agent-skills

Skill Claude CodeCodex

Aligning a mobile app against the OWASP Mobile Application Security Verification Standard (MASVS v2). Use as a review rubric and as the source of truth for which controls apply.