skills.rest
johanruttens
johanruttensCOMMUNITY
Explore all skills by this author →
GitHub

rn-security-audit

Detect security vulnerabilities and leaked secrets in React Native applications.

Updated Dec 23, 2025
Search Tags:#security#vulnerability#react-native#PII#OWASP MASVS#secrets-detection
One-click install
npx skills add https://github.com/johanruttens/paddle-battle --skill rn-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rn-security-audit
Source: https://github.com/johanruttens/paddle-battle/tree/main/.claude/skills/rn-security-audit
Command: npx skills add https://github.com/johanruttens/paddle-battle --skill rn-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify security vulnerabilities and sensitive data exposures in React Native apps across JavaScript/TypeScript and native iOS/Android code, helping teams detect misconfigurations, leaked secrets, and insecure data handling before release.

Core Features & Use Cases

  • Hardcoded secrets detection (API keys, tokens, credentials) across code and config files.
  • PII exposure checks (emails, phone numbers, identifiers) in source and logs.
  • Insecure data storage review (AsyncStorage, Keychain/Keystore) and insecure storage patterns.
  • Authentication flow review (token handling, session management, refresh flows).
  • Network security review (HTTPS, TLS, certificate pinning) and insecure endpoints.
  • OWASP MASVS-aligned guidance for secure mobile apps.

Quick Start

Run a security audit against your React Native project by pointing Claude to the project directory, e.g., '/path/to/your/rn-project'.

Frequently Asked Questions about rn-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect hardcoded secrets and API keys in my React Native app?▼

Security audits scan your React Native project's JavaScript, TypeScript, and native code for hardcoded secrets like API keys, tokens, and credentials across source files and config. The audit identifies exposed patterns and recommends moving secrets to environment variables or secure vaults before deployment.

Can I check for PII exposure and insecure data storage in React Native?▼

Yes. The audit detects personally identifiable information (emails, phone numbers, identifiers) in source code and logs, and identifies insecure storage patterns like AsyncStorage without encryption. It flags data that should use Keychain or Keystore instead.

What does OWASP MASVS compliance mean for mobile app security?▼

OWASP MASVS is a security standard for mobile apps covering authentication, network security, data storage, and vulnerability prevention. Security audits aligned with MASVS verify your React Native app meets industry baseline controls for secrets, TLS, certificate pinning, and session management.

How do I audit network security and TLS configuration in React Native?▼

The audit reviews HTTPS enforcement, TLS versions, certificate pinning setup, and identifies insecure HTTP endpoints in your React Native project. It checks both JavaScript network calls and native iOS/Android networking code for security misconfigurations.

Can I use this security audit for both JavaScript and native React Native code?▼

Yes. The audit covers JavaScript and TypeScript application code plus native iOS and Android code within React Native projects, providing comprehensive vulnerability detection across your entire codebase.

What authentication and session issues does a security audit find?▼

The audit reviews token handling, session management, and refresh token flows for insecure patterns. It identifies risks like unencrypted token storage, missing session timeouts, and improper credential handling that could expose user accounts.

Related Skills

Explore More Software Engineering Skills→
TheBushidoCollectiveTheBushidoCollective
187

jutsu-react-native:react-native-platform

Identify and manage platform-specific code paths in React Native apps.

Official
Intermediate
cenconq25cenconq25
39

security-audit

Audit codebases against OWASP MASVS and generate prioritized remediation reports.

Community
Advanced
RedHatProductSecurityRedHatProductSecurity
47

secure-pipeline

Automates security scanning for CI/CD pipelines with SAST and SCA checks.

Official
Intermediate
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced