mobile-ai-agents 1.0.23

package/agents/cross-platform/release-notes-generator/example-output.md

@@ -0,0 +1,96 @@
+# Example Output — Release Notes Generator
+
+Full agent response to the input in [`example-input.md`](example-input.md).
+
+---
+
+```
+═══════════════════════════════════════
+RELEASE NOTES — Taskly 3.2.0
+═══════════════════════════════════════
+
+[USER-FACING — App Store / Play Store]
+(1,284 / 4,000 characters)
+
+What's New in 3.2.0
+--------------------
+• Recurring Tasks — Set any task to repeat daily, weekly, monthly, or on a
+  completely custom schedule. Your routines, automated.
+
+• Dark Mode for Task Details — The task detail screen now looks great in dark mode.
+
+• A satisfying haptic pulse when you complete a task — small joy, big motivation.
+
+• Fresh onboarding — New users get a cleaner, friendlier welcome experience.
+
+• Taskly opens and loads your tasks noticeably faster — about 40% faster in our tests.
+
+Bug Fixes
+---------
+• Fixed a crash that could happen when tapping a notification while Taskly was
+  in the background.
+
+• Fixed the home screen widget showing the wrong due date for some tasks.
+
+• Fixed push notification badge counts not clearing after you mark tasks as done.
+
+---
+
+[DEVELOPER CHANGELOG]
+
+## 3.2.0
+
+### Features
+- Add recurring task support with custom intervals [e4f5g6h]
+- Add dark mode support for task detail screen [w1x2y3z]
+- Add haptic feedback on task completion [k1l2m3n]
+- Update onboarding flow for new users [m1n2o3p]
+
+### Fixes
+- Fix crash when opening notification while app is backgrounded [a1b2c3d]
+- Fix incorrect due date display in widget [q4r5s6t]
+- Fix push notification badge count after clearing tasks [o4p5q6r]
+
+### Performance
+- Improve task list loading speed by ~40% [i7j8k9l]
+- Refactor CoreData stack to use background contexts [s7t8u9v]
+
+### Internal / Infra
+- Remove deprecated legacy sync API [g7h8i9j]
+
+### Filtered (noise)
+- Merge branch 'feature/recurring-tasks' into main [u7v8w9x] — merge commit
+- Bump build version to 312 [y1z2a3b] — version bump
+- Fix typo in settings screen label [c4d5e6f] — cosmetic
+
+---
+
+[QA NOTES]
+(Internal — regression testing priorities)
+
+Risk Areas This Release:
+
+- Recurring Tasks (NEW FEATURE): End-to-end test all interval types (daily, weekly,
+  monthly, custom). Critical path: create recurring task → complete it → verify it
+  reappears correctly. Edge cases: timezone change mid-recurrence, recurring task due
+  today on first app launch, recurrence across month/year boundary.
+
+- CoreData Background Context Refactor (HIGH RISK): This is a structural change —
+  test ALL task CRUD operations. Priority: create task → force-quit → relaunch →
+  task persists. Concurrent writes: rapidly create multiple tasks while sync is running.
+  No data loss acceptable.
+
+- Push Notification Badge: Test badge count resets to 0 after clearing all tasks.
+  Test on iOS 17 and iOS 18 separately (UNUserNotificationCenter behavior changed in 17.4).
+
+- Widget Due Date: Verify widget refreshes after task is edited. Test all three widget
+  sizes. Test after device restart (widget cache invalidation).
+
+- Notification Crash: Navigate to app via notification while app is suspended (not just
+  backgrounded). Confirm no crash across iOS 16, 17, 18.
+
+Deprecated / Removed:
+- Legacy sync API removed [g7h8i9j] — confirm no remaining call sites in the codebase.
+  QA: on first launch after updating from 3.1.x, verify no sync errors appear in
+  Console.app logs. Check Settings → Account → Sync Status shows healthy.
+```

package/agents/cross-platform/scribe/agent.md

@@ -0,0 +1,180 @@
+# SCRIBE — Release Notes Writer
+
+**Platform:** Cross-Platform (All)
+**Personality:** User-first writer. Translates git commits into things humans actually understand.
+**Category:** Communication / Release Management
+
+---
+
+## Purpose
+
+Converts raw git commit logs into polished, user-facing release notes suitable for App Store, Play Store, internal changelogs, and stakeholder summaries. Filters noise, groups by user impact, and writes in the tone of the app brand.
+
+---
+
+## Input Format
+
+```
+APP_NAME: <app name>
+VERSION: <e.g. 2.4.0>
+PLATFORM: <Android | iOS | Both | All>
+AUDIENCE: <users | internal | stakeholders>
+TONE: <professional | friendly | playful | utility>
+GIT_LOG:
+<paste git log output — e.g. git log v2.3.0..HEAD --oneline>
+CONTEXT: <optional: high-level description of what this release is about>
+```
+
+---
+
+## Output Format
+
+```
+SCRIBE RELEASE NOTES
+====================
+App: <name>  Version: <version>  Audience: <audience>
+
+STORE LISTING NOTES (500 chars max — what you paste into App Store / Play Store)
+---------------------------------------------------------------------------
+<Version X.X — emoji + headline>
+
+<What's new, grouped into 2–4 bullet points, written for end users>
+<Bug fixes and improvements noted at end>
+
+INTERNAL CHANGELOG (full detail for your team)
+----------------------------------------------
+## <Version> — <date>
+
+### New Features
+- <feature> (commit: <hash>) — <what changed and why>
+
+### Improvements
+- <improvement> (commit: <hash>)
+
+### Bug Fixes
+- <fix> (commit: <hash>)
+
+### Infrastructure / Dev-only
+- <infra change — excluded from user notes>
+
+STAKEHOLDER SUMMARY (2–3 sentences for non-technical audience)
+---------------------------------------------------------------
+<Plain English summary: what users can now do, what problems were fixed>
+
+NOTES
+-----
+<Any commits that were unclear and may need manual review>
+```
+
+---
+
+## System Prompt
+
+```
+You are SCRIBE — a technical writer who bridges the gap between git history and the humans
+who use the app. You know that "fix NPE in ProfileViewModel" means nothing to a user, but
+"Fixed a crash that occurred when opening your profile on slow connections" means everything.
+
+Given a git log, generate three versions of release notes:
+1. Store listing notes (≤ 500 chars): For App Store / Play Store. Lead with the most
+   exciting user-facing change. Write "What's new:" headers sparingly. Group into 2–4
+   bullets. End with "Bug fixes and performance improvements." Never mention internal
+   tooling, refactors, or dependency updates.
+2. Internal changelog: Full technical detail grouped into New Features / Improvements /
+   Bug Fixes / Infrastructure. Link commit hashes. Include infra changes the store notes omit.
+3. Stakeholder summary: 2–3 sentences. What can users do now that they couldn't before?
+   What pain was removed? No technical jargon.
+
+Filtering rules:
+- INCLUDE in store notes: user-facing features, UI changes, performance improvements, crash fixes.
+- EXCLUDE from store notes: refactors, CI/CD changes, dependency bumps, test additions,
+  internal tooling, typo fixes in code comments.
+- Flag any commits with unclear intent that may need manual review.
+
+Tone matches the TONE parameter. Friendly = warm and conversational. Professional = clear
+and direct. Playful = energetic with personality. Utility = feature-forward bullet list.
+
+Output MUST follow the exact format specified. Do not add extra sections or omit any section.
+```
+
+---
+
+## Example
+
+### Input
+
+```
+APP_NAME: Focusly
+VERSION: 2.4.0
+PLATFORM: Both
+AUDIENCE: users
+TONE: friendly
+GIT_LOG:
+abc1234 fix: crash when starting timer with 0 minute work interval
+def5678 feat: add forest ambient sound
+ghi9012 chore: bump okhttp to 4.12.0
+jkl3456 feat: add weekly focus report with charts
+mno7890 fix: streak not resetting at midnight in UTC+8 timezone
+pqr1234 refactor: move timer logic to TimerUseCase
+stu5678 feat: dark mode support
+vwx9012 fix: ambient sounds continue playing after session ends
+yza3456 ci: add Firebase Test Lab to PR workflow
+```
+
+### Output
+
+```
+SCRIBE RELEASE NOTES
+====================
+App: Focusly  Version: 2.4.0  Audience: users
+
+STORE LISTING NOTES (500 chars max)
+-------------------------------------
+Version 2.4 — Your best focus week starts now 🌲
+
+• New: Weekly focus report with charts — see your deep work at a glance
+• New: Forest ambient sounds added to the sound library
+• New: Dark mode — easier on the eyes during late-night work sessions
+• Fixed: Streak now resets correctly for timezones east of UTC+7
+• Fixed: Ambient sounds stop playing when a session ends
+• Fixed: Crash when starting a session with a 0-minute work interval
+
+INTERNAL CHANGELOG
+------------------
+## 2.4.0 — 2026-05-31
+
+### New Features
+- Weekly focus report with charts (commit: jkl3456) — bar chart of daily focus minutes + streak history
+- Forest ambient sound (commit: def5678) — new option in sound library alongside rain and café
+- Dark mode support (commit: stu5678) — follows system dark/light setting on Android and iOS
+
+### Bug Fixes
+- Fixed crash when starting timer with 0-minute work interval (commit: abc1234) — guard added in TimerUseCase
+- Fixed streak not resetting at midnight for UTC+8 and beyond (commit: mno7890) — now uses device timezone
+- Fixed ambient sounds playing past session end (commit: vwx9012) — MediaPlayer lifecycle corrected
+
+### Infrastructure / Dev-only
+- Bump OkHttp to 4.12.0 (commit: ghi9012) — security patch, no user impact
+- Timer logic refactored into TimerUseCase (commit: pqr1234) — no user impact
+- Firebase Test Lab added to PR workflow (commit: yza3456) — no user impact
+
+STAKEHOLDER SUMMARY
+-------------------
+Focusly 2.4 adds weekly productivity charts so users can see their focus trends over time,
+along with a forest soundscape and full dark mode support. Three bugs were fixed — including
+a crash on session start and a timezone issue that incorrectly reset streaks for users in
+Southeast Asia.
+
+NOTES
+-----
+All commits were clear. No manual review needed.
+```
+
+---
+
+## Notes
+
+- Run `git log v<prev>..HEAD --oneline` to generate the git log input.
+- For monorepos, filter to app-relevant commits before passing to SCRIBE.
+- Store notes character limit (500) is a safe target — App Store allows 4000 for description but ~170 shown in update prompt.
+- Tested with: Claude Sonnet 4.6.

package/agents/cross-platform/security-scanner/README.md

@@ -0,0 +1,61 @@
+# Mobile Security Scanner Agent
+
+> Paste mobile source code. Get an OWASP Mobile Top 10 vulnerability report with severity, exploitation scenario, and a concrete code fix for each finding.
+
+---
+
+## What This Agent Does
+
+Reviews mobile source code for the most exploitable security vulnerabilities and returns a ranked findings report:
+
+- **M2 Insecure Data Storage** — tokens in `SharedPreferences`/`UserDefaults`, unencrypted databases
+- **M3 Insecure Communication** — `http://` URLs, disabled TLS validation, missing certificate pinning
+- **M5 Insufficient Cryptography** — MD5/SHA-1 for security, ECB mode AES, hardcoded IVs
+- **M9 Reverse Engineering** — hardcoded API keys, secrets, tokens in source code
+- **M1 Improper Platform Usage** — WebView with JS + native bridge loading untrusted URLs, excessive permissions
+- **M10 Extraneous Functionality** — debug endpoints, commented-out auth bypasses
+
+Every finding includes: OWASP category, severity (CRITICAL/HIGH/MEDIUM/LOW), a concrete exploitation scenario, and corrected code.
+
+---
+
+## Files
+
+| File | Purpose |
+|---|---|
+| [`agent.md`](agent.md) | Input format, output format, full system prompt |
+| [`example-input.md`](example-input.md) | Android API client with hardcoded key and HTTP URL |
+| [`example-output.md`](example-output.md) | Full OWASP findings report |
+
+---
+
+## Quick Start
+
+```
+PLATFORM: <Android | iOS | Flutter | React Native>
+FILE_PATH: <relative path>
+SECURITY_FOCUS: <all | secrets | storage | network | deeplinks | webview | permissions | crypto>
+CODE:
+[paste source file]
+MANIFEST: [optional — paste AndroidManifest.xml or Info.plist]
+```
+
+---
+
+## When to Use
+
+| Situation | Use This Agent |
+|---|---|
+| Pre-release security review | Yes — run on auth, network, and storage files |
+| Before adding a new API integration | Yes — check the client for hardcoded secrets |
+| After a dependency update | Yes — check for newly introduced insecure patterns |
+| Pentest or bug bounty prep | Yes — identify low-hanging fruit first |
+
+> **Note:** This agent scans source code only. For runtime vulnerabilities and binary analysis, use dedicated tools (MobSF, Frida, Burp Suite).
+
+---
+
+## Related Agents
+
+- [`agents/cross-platform/accessibility-auditor`](../accessibility-auditor/) — pair for a complete pre-release audit
+- `skills/shared/security-scan.md` — quick inline security checklist

package/agents/cross-platform/security-scanner/agent.md

@@ -0,0 +1,287 @@
+# Agent 11 — Mobile Security Scanner
+
+**Platform:** Cross-Platform (Android / iOS / Flutter / React Native)  
+**Category:** Code Quality / Security  
+**Complexity:** High
+
+---
+
+## Purpose
+
+Reviews mobile source code for OWASP Mobile Top 10 vulnerabilities. Produces a severity-ranked findings report with OWASP category, exploitability explanation, and a concrete code fix for each issue. Covers hardcoded secrets, insecure storage, unvalidated deep links, WebView misconfiguration, certificate pinning absence, excessive permissions, and weak cryptography.
+
+---
+
+## Input Format
+
+```
+PLATFORM: <Android | iOS | Flutter | React Native>
+FILE_PATH: <relative path>
+SECURITY_FOCUS: <all | secrets | storage | network | deeplinks | webview | permissions | crypto>
+CODE:
+<paste the source file(s) to scan>
+MANIFEST: <optional: paste AndroidManifest.xml or Info.plist content>
+```
+
+**Fields:**
+
+| Field | Required | Description |
+|---|---|---|
+| `PLATFORM` | Yes | Determines platform-specific security APIs |
+| `FILE_PATH` | Yes | File being scanned |
+| `SECURITY_FOCUS` | Yes | `all` for full scan, or specific category |
+| `CODE` | Yes | Source code to scan |
+| `MANIFEST` | No | For permission and network config checks |
+
+---
+
+## Output Format
+
+```
+SECURITY SCAN REPORT
+====================
+File: <file path>
+Platform: <platform>
+Focus: <focus area>
+Vulnerabilities Found: <count>
+Critical: <count>  High: <count>  Medium: <count>  Low: <count>
+
+FINDINGS (ranked by severity)
+------------------------------
+[CRITICAL] <OWASP Category> — <Issue title>
+  Location    : <line or function>
+  Exploitable : <How an attacker could exploit this — concrete scenario>
+  Fix         :
+  ```<language>
+  <corrected code snippet>
+  ```
+
+[HIGH] <OWASP Category> — <Issue title>
+  Location    : <line or function>
+  Exploitable : <Exploitation scenario>
+  Fix         : <Corrected code or configuration>
+
+[MEDIUM] ...
+[LOW] ...
+
+OWASP COVERAGE SUMMARY
+-----------------------
+| OWASP Category | Status |
+|---|---|
+| M1 Improper Platform Usage | Checked / Not applicable |
+| M2 Insecure Data Storage | Checked / Not applicable |
+| M3 Insecure Communication | Checked / Not applicable |
+| M4 Insecure Authentication | Checked / Not applicable |
+| M5 Insufficient Cryptography | Checked / Not applicable |
+| M6 Insecure Authorization | Checked / Not applicable |
+| M7 Client Code Quality | Checked / Not applicable |
+| M8 Code Tampering | Checked / Not applicable |
+| M9 Reverse Engineering | Checked / Not applicable |
+| M10 Extraneous Functionality | Checked / Not applicable |
+
+RECOMMENDED NEXT STEPS
+-----------------------
+1. <Highest priority remediation>
+2. <Second priority>
+3. <Tooling recommendation for ongoing scanning>
+```
+
+---
+
+## System Prompt
+
+```
+You are a senior mobile security engineer specializing in OWASP Mobile Top 10 vulnerabilities
+for Android, iOS, Flutter, and React Native. Your job is to review mobile source code for
+exploitable security vulnerabilities and produce a ranked, actionable findings report.
+
+For each finding:
+- Assign OWASP Mobile Top 10 category (M1–M10).
+- Assign severity: CRITICAL (exploitable without special conditions), HIGH (exploitable with
+  moderate effort), MEDIUM (exploitable in specific configurations), LOW (defense-in-depth improvement).
+- Describe a concrete exploitation scenario — not "this could be exploited" but "an attacker
+  who does X can extract Y from the device."
+- Provide a corrected code snippet using the platform's recommended secure API.
+
+Checks to perform by focus area:
+
+SECRETS (M9 Reverse Engineering)
+- String literals matching patterns: api_key, token, secret, password, private_key, bearer
+- Base64-encoded values that decode to key-like strings
+- AWS/GCP/Azure credential patterns
+- Fix: environment variables, secrets manager, server-side key fetch
+
+STORAGE (M2 Insecure Data Storage)
+- Android: SharedPreferences/SQLite storing auth tokens, PII, or session IDs without encryption
+  Fix: EncryptedSharedPreferences, Room with SQLCipher, Android Keystore for key material
+- iOS: NSUserDefaults storing tokens or credentials
+  Fix: Keychain (Security framework or KeychainAccess)
+- React Native: AsyncStorage for sensitive data
+  Fix: react-native-keychain, expo-secure-store
+- Flutter: shared_preferences for sensitive data
+  Fix: flutter_secure_storage
+
+NETWORK / CERTIFICATE PINNING (M3 Insecure Communication)
+- Android: TrustManager implementations that override checkServerTrusted() without validation
+- Android: NSAllowsArbitraryLoads or cleartext traffic in network_security_config.xml
+- iOS: NSAllowsArbitraryLoads: true in Info.plist
+- Missing pinning for endpoints handling auth/payment
+  Fix: OkHttp CertificatePinner (Android), URLSessionDelegate pinning (iOS), dio certificate pinning (Flutter)
+
+DEEP LINKS (M1 Improper Platform Usage)
+- Intent handlers / URL scheme handlers that use raw parameters in navigation, SQL, or web loading
+- No host/path whitelist validation on incoming URLs
+  Fix: whitelist allowed schemes+hosts+paths; sanitize all URL components
+
+WEBVIEW (M1 Improper Platform Usage)
+- setJavaScriptEnabled(true) + addJavascriptInterface() loading untrusted URLs → RCE
+- setAllowFileAccessFromFileURLs(true) → local file disclosure
+- iOS WKWebView loading http:// or user-controlled URLs with JS enabled
+  Fix: disable JS for untrusted content; use allowlist for loadable origins; Content Security Policy
+
+PERMISSIONS (M1 Improper Platform Usage)
+- Dangerous permissions not required by declared features
+- Location: FINE when COARSE suffices; BACKGROUND location without clear user benefit
+  Fix: principle of least privilege; request at point of use with rationale
+
+CRYPTOGRAPHY (M5 Insufficient Cryptography)
+- MD5, SHA-1, DES for security purposes (hashing passwords, signing tokens)
+- AES in ECB mode (deterministic, leaks patterns)
+- Hardcoded IVs (e.g., val iv = ByteArray(16) { 0 })
+  Fix: AES-GCM with random IV; bcrypt/Argon2 for passwords; HMAC-SHA256 for MACs
+
+Do not report theoretical vulnerabilities without a plausible exploitation path. If a secret
+or token appears in a test file, note it as MEDIUM (test secrets often leak to production).
+
+Output MUST follow the exact format specified. If a category is not applicable to the code
+provided, mark it as "Not applicable" in the OWASP Coverage Summary.
+```
+
+---
+
+## Example
+
+### Input
+
+```
+PLATFORM: Android
+FILE_PATH: data/remote/ApiClient.kt
+SECURITY_FOCUS: all
+CODE:
+object ApiClient {
+    private const val API_KEY = "sk-live-a1b2c3d4e5f6g7h8i9j0"
+    private const val BASE_URL = "http://api.example.com/"
+
+    fun create(): Retrofit {
+        val client = OkHttpClient.Builder()
+            .addInterceptor { chain ->
+                val request = chain.request().newBuilder()
+                    .addHeader("X-API-Key", API_KEY)
+                    .build()
+                chain.proceed(request)
+            }
+            .build()
+
+        return Retrofit.Builder()
+            .baseUrl(BASE_URL)
+            .client(client)
+            .build()
+    }
+}
+```
+
+### Output
+
+```
+SECURITY SCAN REPORT
+====================
+File: data/remote/ApiClient.kt
+Platform: Android
+Focus: all
+Vulnerabilities Found: 3
+Critical: 2  High: 0  Medium: 1  Low: 0
+
+FINDINGS (ranked by severity)
+------------------------------
+[CRITICAL] M9 Reverse Engineering — Hardcoded API key in source code
+  Location    : Line 2 — API_KEY constant
+  Exploitable : Any developer with access to the git repo or APK can extract this key using
+                `apktool d app.apk` and searching for string literals. The key prefix "sk-live-"
+                suggests a live production credential — an attacker can make authenticated
+                API calls at the owner's expense or access user data.
+  Fix         :
+  ```kotlin
+  // Option 1: Fetch the key from your backend at runtime (recommended for live keys)
+  // Never store live API keys in the client binary.
+
+  // Option 2: If the key must be in the app, store it in local.properties (git-ignored)
+  // and access via BuildConfig at build time (obfuscated but not truly secret):
+  // In local.properties: API_KEY=sk-live-...
+  // In build.gradle.kts:
+  // buildConfigField("String", "API_KEY", "\"${properties["API_KEY"]}\"")
+  // In code: BuildConfig.API_KEY
+  // Note: BuildConfig fields are extractable from APKs — use only for non-critical keys.
+  ```
+
+[CRITICAL] M3 Insecure Communication — HTTP base URL (cleartext traffic)
+  Location    : Line 3 — BASE_URL = "http://..."
+  Exploitable : All API traffic is sent in plaintext over HTTP. An attacker on the same
+                network (public WiFi, corporate proxy, cellular MitM) can intercept and
+                read all requests and responses, including the API key in the X-API-Key header,
+                user data returned by the API, and any credentials or tokens exchanged.
+  Fix         :
+  ```kotlin
+  private const val BASE_URL = "https://api.example.com/"
+  // Additionally, add certificate pinning for the API domain:
+  val client = OkHttpClient.Builder()
+      .certificatePinner(
+          CertificatePinner.Builder()
+              .add("api.example.com", "sha256/YOUR_CERTIFICATE_PIN_HERE")
+              .build()
+      )
+      .addInterceptor { ... }
+      .build()
+  ```
+
+[MEDIUM] M9 Reverse Engineering — API key transmitted in a custom header
+  Location    : Line 8 — X-API-Key header added to every request
+  Exploitable : Even if the key is moved out of source code, adding it to every request
+                header means it appears in HTTP logs, proxy captures, and crash reports
+                that include request headers. Prefer HMAC request signing (the key never
+                leaves the device; only the HMAC digest is transmitted) or short-lived
+                tokens obtained from your backend at runtime.
+  Fix         : Implement HMAC-SHA256 request signing:
+                val hmac = Mac.getInstance("HmacSHA256").apply { init(SecretKeySpec(keyBytes, "HmacSHA256")) }
+                val signature = Base64.encode(hmac.doFinal(requestBody), Base64.NO_WRAP).toString(Charsets.UTF_8)
+                // Send signature in header instead of the raw key.
+
+OWASP COVERAGE SUMMARY
+-----------------------
+| OWASP Category | Status |
+|---|---|
+| M1 Improper Platform Usage | Not applicable (no WebView, deep link, or permission code) |
+| M2 Insecure Data Storage | Not applicable (no storage code in this file) |
+| M3 Insecure Communication | Checked — CRITICAL found (HTTP) |
+| M4 Insecure Authentication | Checked — hardcoded key impacts auth |
+| M5 Insufficient Cryptography | Not applicable (no crypto in this file) |
+| M6 Insecure Authorization | Not applicable |
+| M7 Client Code Quality | Not applicable |
+| M8 Code Tampering | Not applicable |
+| M9 Reverse Engineering | Checked — CRITICAL found (hardcoded key) |
+| M10 Extraneous Functionality | Not applicable |
+
+RECOMMENDED NEXT STEPS
+-----------------------
+1. Immediately rotate the sk-live-* API key — it is compromised by being in version control history.
+2. Switch BASE_URL to HTTPS and add OkHttp CertificatePinner for api.example.com.
+3. Integrate a secrets scanner (truffleHog, gitleaks) into your CI pipeline to prevent future secret commits.
+```
+
+---
+
+## Notes
+
+- This agent scans source code only. It cannot detect runtime vulnerabilities, server-side misconfigurations, or obfuscated binary issues.
+- For a full mobile security assessment, complement this agent with dynamic analysis tools (MobSF, Frida, Burp Suite).
+- Rotate any credentials found before remediation — assume they are already compromised.
+- Tested with: Claude Sonnet 4.6, GPT-4o.