Individual skill

mobile-security

Android and iOS hardening on a device you do not control: hardware-backed credential storage, exported components and IPC, verified deep links, transport defaults and pinning rotation, server-side attestation over client-side root detection, screen capture, and release-build hygiene — including React Native and Flutter packaging. Use when generating Android or iOS app code, manifests, or native modules, wiring deep links or WebViews, or deciding what a mobile client is trusted to assert.

skills/mobile-security/SKILL.md

Read pinned source

Source commit eaba88102d91df65a9aa6397e8507c315c018f5e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

Standard SKILL.md format has not been attested at this commit. No installation command is available; inspect the source.

Repository context

Repository stars (not skill ratings): 23
Repository last updated: Aug 14, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

claude-skills Repository topic
llm Repository topic
security Repository topic
skills Repository topic
engineering Derived category
engineering-web Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 9,815 bytes
checklists/android_manifest.yamlasset · 1,811 bytes
checklists/ios_keychain_ats.yamlasset · 1,932 bytes
references/platform-specifics.mddoc · 5,691 bytes
references/verifying-findings.mddoc · 4,191 bytes
tests/corpus.jsonasset · 4,141 bytes

Read excerpt


# Mobile Application Security

## Rules (for AI agents)

### ALWAYS
- Start from the premise that **the device belongs to whoever is holding it**. The
  app runs on hardware an attacker can root or jailbreak, instrument at runtime, and
  read at rest. Everything shipped in the package is extractable, every client-side
  check is removable, and every local check can be made to return the answer the
  attacker wants. What you actually control is the backend's willingness to act — so
  any decision that matters is made server-side, on evidence the server verified.
- Issue short-lived, device-scoped tokens from a backend rather than shipping an API
  key, signing key, or backend credential in source, resources, `strings.xml`,
  `BuildConfig`, or `Info.plist`. Anyone can download the package and read it.