skills.rest
TheViziusGroup
TheViziusGroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

mobile-security

Implements OWASP MASVS-compliant security controls and MFA for iOS, Android, and React Native apps.

1|Updated Aug 10, 2026
Search Tags:#passkeys#mfa#mobile security#certificate pinning#android keystore#owasp masvs#ios keychain
One-click install
npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill mobile-security-theviziusgroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mobile-security
Source: https://github.com/TheViziusGroup/vibe-engineering-skills/tree/main/plugins/mobile-development/skills/mobile-security
Command: npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill mobile-security-theviziusgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Mobile apps frequently ship with hardcoded credentials, weak storage, insecure network calls, and non-compliant authentication, exposing them to the OWASP Mobile Top 10 risks. This Skill provides concrete, standards-aligned guidance for securing mobile applications against MASVS v2.1.0 and MASTG requirements. ## Core Features & Use Cases - Standards-Aligned Security Design: Covers all eight MASVS v2.1.0 control groups (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY) and the OWASP Mobile Top 10 2024, including M1 Improper Credential Usage. - Hardware-Backed Storage & Auth: Implements iOS Keychain/Secure Enclave, Android Keystore/StrongBox with key attestation, biometric-bound keys, SPKI certificate pinning, TLS 1.3, and OAuth 2.0 Authorization Code + PKCE. - MFA & CI Security Testing: Configures FIDO2/passkeys, TOTP, Entra ID MFA with Conditional Access and MSAL broker SSO, plus MobSF integration in CI to fail builds on MASVS violations. - Use Case: A team building a React Native banking app uses this Skill to implement Play Integrity and App Attest checks, pin SPKI public keys with backup pins, and add passkey-based step-up authentication for high-risk transactions. ## Quick Start Use the mobile-security skill to review my Android app's authentication flow and recommend MASVS-compliant fixes for credential storage and network security.

Frequently Asked Questions about mobile-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement certificate pinning in a mobile app?▼

Pin SPKI SHA-256 public key hashes rather than certificates, and always configure a backup pin. On Android use OkHttp CertificatePinner or TrustKit with Network Security Configuration; on iOS use TrustKit with kTSKPublicKeyHashes; React Native can use react-native-ssl-public-key-pinning.

How do I add passkey authentication to iOS and Android apps?▼

On iOS use AuthenticationServices with AASA associated domains and iCloud Keychain sync. On Android use the Credential Manager API with Digital Asset Links, which unifies passkeys, passwords, and federated sign-in including third-party providers on Android 14+.

What is the difference between MASVS v2.1.0 and MASVS Level 2?▼

MASVS v2.0.0 removed verification levels and replaced them with MAS Testing Profiles, so requesting MASVS Level 2 is outdated framing. Version 2.1.0 adds the MASVS-PRIVACY control group, bringing the standard to eight control groups with 24 requirements verified via MASTG.

Does Android Keystore store keys in secure hardware?▼

Android Keystore keys may live in the TEE or in StrongBox, a dedicated secure element available from API 28. Verify placement with isInsideSecureHardware() and use key attestation to confirm the key's hardware backing and properties.

Why is SMS OTP discouraged for mobile MFA?▼

SMS OTP is vulnerable to SIM-swap and SS7 interception attacks, and NIST SP 800-63B restricts its use. Prefer phishing-resistant FIDO2/passkeys, TOTP per RFC 6238, or push MFA with number matching such as Microsoft Authenticator.

How do I enforce mobile security checks in CI pipelines?▼

Integrate MobSF into CI to run static and dynamic analysis and fail builds on MASVS-CRYPTO or MASVS-STORAGE violations. For deeper testing, use Drozer on Android and objection or Frida for runtime instrumentation.

Related Skills

Explore More Software Engineering Skills→
securityfortechsecurityfortech
6

mobile-network-security

Detect insecure network protocols and configurations in Android and iOS mobile applications.

Official
Advanced
wgpsecwgpsec
1.7k

android-app-pentesting

Tests Android APK security through static analysis, Frida dynamic hooking, and component auditing.

Official
Advanced
FelixRauchFelixRauch

device-integrity

Verify iOS device and app integrity with Apple DeviceCheck and App Attest.

Community
Advanced
HabitaNexusHabitaNexus
1

Security Best Practices

Implement multi-layer security for Flutter apps with obfuscation, certificate pinning, and secure storage.

Official
Advanced