What problem does it solve? Android apps often ship with exploitable weaknesses like exported components, cleartext traffic, unencrypted tokens, and misconfigured WebViews. This Skill provides a structured, MASVS-aligned audit process that turns an ad-hoc security review into a repeatable methodology with concrete fixes. ## Core Features & Use Cases - Attack Surface Inventory: Systematically greps for exported components, deep links, permissions, network config, storage locations, WebViews, native code, and crypto usage. - MASVS Category Walkthrough: Covers STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, and RESILIENCE with specific checks like EncryptedSharedPreferences, certificate pinning, BiometricPrompt configuration, and PendingIntent mutability. - Risk-Ranked Reporting: Produces a report grouped by MASVS category with a severity summary table and a recommended remediation order. - Use Case: Before a penetration test or Play Store review, run this audit on your app to find an exported activity leaking data and a deep link vulnerable to IDOR, then get the exact manifest and validation fixes. ## Quick Start Ask the assistant to run a MASVS security audit on this Android project and report findings by category and risk.
