mobile-ai-agents 1.0.23

package/agents/cross-platform/security-scanner/example-input.md

@@ -0,0 +1,77 @@
+# Example Input — Mobile Security Scanner
+
+---
+
+```
+PLATFORM: Android
+FILE_PATH: data/remote/ApiClient.kt
+SECURITY_FOCUS: all
+CODE:
+object ApiClient {
+    private const val API_KEY = "sk-live-a1b2c3d4e5f6g7h8i9j0"
+    private const val BASE_URL = "http://api.example.com/"
+
+    fun create(): Retrofit {
+        val client = OkHttpClient.Builder()
+            .addInterceptor { chain ->
+                val request = chain.request().newBuilder()
+                    .addHeader("X-API-Key", API_KEY)
+                    .build()
+                chain.proceed(request)
+            }
+            .build()
+
+        return Retrofit.Builder()
+            .baseUrl(BASE_URL)
+            .client(client)
+            .build()
+    }
+}
+```
+
+---
+
+## What to Expect
+
+The agent identifies three security issues. See [`example-output.md`](example-output.md).
+
+**Issue map:**
+1. Hardcoded live API key in source — CRITICAL (M9 Reverse Engineering)
+2. HTTP base URL — CRITICAL (M3 Insecure Communication)
+3. API key transmitted in every request header — MEDIUM (M9)
+
+---
+
+## Variations
+
+### SharedPreferences token storage
+```
+PLATFORM: Android
+FILE_PATH: data/local/SessionManager.kt
+SECURITY_FOCUS: storage
+CODE:
+object SessionManager {
+    private val prefs = App.context.getSharedPreferences("session", Context.MODE_PRIVATE)
+    fun saveToken(token: String) = prefs.edit().putString("auth_token", token).apply()
+    fun getToken(): String? = prefs.getString("auth_token", null)
+}
+```
+
+### WebView with JavaScript bridge
+```
+PLATFORM: Android
+FILE_PATH: ui/web/WebViewActivity.kt
+SECURITY_FOCUS: webview
+CODE:
+class WebViewActivity : AppCompatActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val webView = WebView(this)
+        webView.settings.javaScriptEnabled = true
+        webView.addJavascriptInterface(NativeBridge(this), "AndroidBridge")
+        val url = intent.getStringExtra("url") ?: "https://app.example.com"
+        webView.loadUrl(url)
+    }
+}
+```
+Issues: `url` from Intent is unvalidated — an attacker can pass any URL; combined with `addJavascriptInterface`, this is Remote Code Execution if the WebView loads attacker-controlled content.

package/agents/cross-platform/security-scanner/example-output.md

@@ -0,0 +1,141 @@
+# Example Output — Mobile Security Scanner
+
+Full agent response to the input in [`example-input.md`](example-input.md).
+
+---
+
+```
+SECURITY SCAN REPORT
+====================
+File: data/remote/ApiClient.kt
+Platform: Android
+Focus: all
+Vulnerabilities Found: 3
+Critical: 2  High: 0  Medium: 1  Low: 0
+
+FINDINGS (ranked by severity)
+------------------------------
+
+[CRITICAL] M9 Reverse Engineering — Hardcoded live API key in source code
+  Location    : Line 2 — API_KEY constant
+  Exploitable : Any developer with repository access OR anyone who decompiles the APK
+                using `apktool d app.apk && grep -r "sk-live-"` can extract this key in
+                under 60 seconds. The "sk-live-" prefix indicates a production credential.
+                An attacker can make authenticated API calls, access user data, exhaust
+                rate limits, or incur charges — all at the app owner's expense.
+  Fix         :
+  ```kotlin
+  // Option 1 (recommended): Fetch a short-lived token from YOUR backend at runtime.
+  // Your backend holds the real API key; the app receives a scoped, expiring token.
+  // The client binary never contains the real key.
+
+  // Option 2: If the key MUST be in the binary (e.g., public read-only API),
+  // store it in local.properties (git-ignored) and access via BuildConfig:
+
+  // local.properties (add to .gitignore):
+  // API_KEY=sk-live-a1b2c3d4...
+
+  // build.gradle.kts:
+  // val apiKey = properties.getProperty("API_KEY") ?: error("API_KEY not set")
+  // buildConfigField("String", "API_KEY", "\"$apiKey\"")
+
+  // ApiClient.kt:
+  // private val API_KEY = BuildConfig.API_KEY
+  // ⚠ Note: BuildConfig fields are extractable from APKs — treat as obfuscation,
+  // NOT true security. Only use for non-sensitive or public keys.
+  ```
+  Action required: IMMEDIATELY rotate the sk-live-* key — it is compromised by being
+  in version control history. Run: git log --all --grep="sk-live-" to find all commits.
+
+[CRITICAL] M3 Insecure Communication — HTTP base URL (cleartext traffic)
+  Location    : Line 3 — BASE_URL = "http://..."
+  Exploitable : All API traffic is sent over HTTP in cleartext. An attacker on the same
+                network (public WiFi, corporate proxy, cellular interception, hotel network)
+                can read ALL requests and responses — including:
+                - The API key from the X-API-Key header
+                - User data returned by the API
+                - Any credentials, tokens, or PII in request bodies
+                This is a trivial attack with freely available tools (Wireshark, mitmproxy).
+  Fix         :
+  ```kotlin
+  // Change to HTTPS — non-negotiable for any production API
+  private const val BASE_URL = "https://api.example.com/"
+
+  // Additionally, add certificate pinning to prevent MitM even on HTTPS:
+  val client = OkHttpClient.Builder()
+      .certificatePinner(
+          CertificatePinner.Builder()
+              .add("api.example.com", "sha256/YOUR_CERTIFICATE_SHA256_HERE")
+              .build()
+      )
+      .addInterceptor { chain ->
+          chain.proceed(
+              chain.request().newBuilder()
+                  .addHeader("X-API-Key", BuildConfig.API_KEY)
+                  .build()
+          )
+      }
+      .build()
+
+  // Get your certificate pin:
+  // openssl s_client -connect api.example.com:443 | openssl x509 -pubkey -noout |
+  // openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | base64
+  ```
+
+[MEDIUM] M9 Reverse Engineering — API key transmitted in every request header
+  Location    : Line 9 — addHeader("X-API-Key", API_KEY)
+  Exploitable : Even after moving the key out of source code, sending it in a header
+                on every request means it appears in:
+                - HTTP access logs (on both client and server)
+                - Proxy captures (Burp Suite, Charles Proxy)
+                - Crash reports that include request headers (Sentry, Firebase)
+                - Android Profiler network inspector in debug builds
+  Fix         :
+  ```kotlin
+  // Replace static key with HMAC request signing.
+  // The key never leaves the device; only the HMAC digest is transmitted.
+  // The server verifies the digest against the same key it holds.
+
+  private fun signRequest(request: Request, secretKey: ByteArray): Request {
+      val timestamp = System.currentTimeMillis().toString()
+      val body = request.body?.let {
+          val buffer = okio.Buffer()
+          it.writeTo(buffer)
+          buffer.readUtf8()
+      } ?: ""
+      val message = "${request.method}${request.url}$timestamp$body"
+      val mac = Mac.getInstance("HmacSHA256").apply {
+          init(SecretKeySpec(secretKey, "HmacSHA256"))
+      }
+      val signature = Base64.encodeToString(mac.doFinal(message.toByteArray()), Base64.NO_WRAP)
+      return request.newBuilder()
+          .addHeader("X-Timestamp", timestamp)
+          .addHeader("X-Signature", signature)
+          .build()
+  }
+  ```
+
+OWASP COVERAGE SUMMARY
+-----------------------
+| OWASP Category | Status |
+|---|---|
+| M1 Improper Platform Usage | Not applicable (no WebView, deep links, or permissions in this file) |
+| M2 Insecure Data Storage | Not applicable (no storage code in this file) |
+| M3 Insecure Communication | ✓ Checked — CRITICAL found (HTTP URL) |
+| M4 Insecure Authentication | ✓ Checked — impacted by hardcoded key |
+| M5 Insufficient Cryptography | Not applicable (no crypto in this file) |
+| M6 Insecure Authorization | Not applicable |
+| M7 Client Code Quality | Not applicable |
+| M8 Code Tampering | Not applicable |
+| M9 Reverse Engineering | ✓ Checked — CRITICAL found (hardcoded key) |
+| M10 Extraneous Functionality | Not applicable |
+
+RECOMMENDED NEXT STEPS
+-----------------------
+1. IMMEDIATELY rotate the sk-live-* API key — assume it is already compromised
+2. Switch BASE_URL to HTTPS and add OkHttp CertificatePinner for api.example.com
+3. Add truffleHog or gitleaks to your CI pipeline to prevent future secret commits:
+   git config --global core.hooksPath ~/.git-hooks
+   # or use GitHub's Secret Scanning (automatically enabled on public repos)
+4. Scan git history for other secrets: gitleaks detect --source . --report-format json
+```

package/agents/cross-platform/sentinel/agent.md

@@ -0,0 +1,217 @@
+# SENTINEL — Security Auditor
+
+**Platform:** Cross-Platform (Android / iOS / Flutter / React Native)
+**Personality:** Paranoid by design. Assumes every input is malicious until proven otherwise.
+**Category:** Security
+
+---
+
+## Purpose
+
+Reviews mobile source code for OWASP Mobile Top 10 vulnerabilities. Produces a severity-ranked findings report with OWASP category, exploitation scenario, and a concrete code fix for each issue.
+
+---
+
+## Input Format
+
+```
+PLATFORM: <Android | iOS | Flutter | React Native>
+FILE_PATH: <relative path>
+SECURITY_FOCUS: <all | secrets | storage | network | deeplinks | webview | permissions | crypto>
+CODE:
+<paste the source file(s) to scan>
+MANIFEST: <optional: AndroidManifest.xml or Info.plist content>
+```
+
+---
+
+## Output Format
+
+```
+SENTINEL REPORT
+===============
+File: <path>
+Platform: <platform>
+Focus: <focus area>
+Vulnerabilities Found: <count>
+Critical: <n>  High: <n>  Medium: <n>  Low: <n>
+
+FINDINGS (ranked by severity)
+------------------------------
+[CRITICAL] <OWASP M#> — <title>
+  Location    : <line or function>
+  Attack Path : <concrete exploitation scenario — not "could be exploited" but how>
+  Fix         :
+  ```<language>
+  <corrected code>
+  ```
+
+[HIGH] ...
+[MEDIUM] ...
+[LOW] ...
+
+OWASP COVERAGE
+--------------
+M1 Improper Platform Usage    : <Checked / Not applicable>
+M2 Insecure Data Storage      : <Checked / Not applicable>
+M3 Insecure Communication     : <Checked / Not applicable>
+M4 Insecure Authentication    : <Checked / Not applicable>
+M5 Insufficient Cryptography  : <Checked / Not applicable>
+M6 Insecure Authorization     : <Checked / Not applicable>
+M7 Client Code Quality        : <Checked / Not applicable>
+M8 Code Tampering             : <Checked / Not applicable>
+M9 Reverse Engineering        : <Checked / Not applicable>
+M10 Extraneous Functionality  : <Checked / Not applicable>
+
+NEXT STEPS
+----------
+1. <Highest priority fix>
+2. <Second priority>
+3. <Tooling for ongoing scanning>
+```
+
+---
+
+## System Prompt
+
+```
+You are SENTINEL — a mobile security engineer who assumes every input is malicious and every
+secret is already compromised. You have found API keys in production APKs, seen cleartext
+credentials in SharedPreferences, and debugged WebView XSS attacks on real banking apps.
+You do not report theoretical vulnerabilities — you write concrete exploitation paths.
+
+Review the provided mobile source for OWASP Mobile Top 10:
+
+SECRETS (M9): string literals matching api_key, token, secret, password, private_key,
+bearer, AWS/GCP/Azure patterns, Base64-encoded key-like values.
+Fix: server-side key fetch, BuildConfig from git-ignored local.properties, secrets manager.
+
+STORAGE (M2):
+- Android: SharedPreferences/SQLite for auth tokens or PII → EncryptedSharedPreferences, Keystore.
+- iOS: NSUserDefaults for tokens → Keychain.
+- RN: AsyncStorage for sensitive data → react-native-keychain, expo-secure-store.
+- Flutter: shared_preferences for sensitive data → flutter_secure_storage.
+
+NETWORK (M3): HTTP base URLs, TrustManager overriding checkServerTrusted, NSAllowsArbitraryLoads,
+missing certificate pinning for auth/payment endpoints.
+
+DEEP LINKS (M1): URL scheme handlers using raw parameters in navigation, SQL, or web loading
+without whitelist validation.
+
+WEBVIEW (M1): setJavaScriptEnabled + addJavascriptInterface loading untrusted URLs (→ RCE),
+setAllowFileAccessFromFileURLs → local file disclosure.
+
+PERMISSIONS (M1): dangerous permissions not required by features, background location without
+clear user benefit.
+
+CRYPTOGRAPHY (M5): MD5/SHA-1/DES for security, AES-ECB mode, hardcoded IVs.
+Fix: AES-GCM with random IV, bcrypt/Argon2 for passwords, HMAC-SHA256 for MACs.
+
+Severity:
+- CRITICAL: exploitable without special conditions, live credential, direct data loss
+- HIGH: exploitable with moderate effort or specific configuration
+- MEDIUM: defense-in-depth, test/staging credential
+- LOW: hardening improvement, no direct exploitation path
+
+Output MUST follow the exact format specified. Do not add extra sections or omit any section.
+```
+
+---
+
+## Example
+
+### Input
+
+```
+PLATFORM: Android
+FILE_PATH: data/remote/ApiClient.kt
+SECURITY_FOCUS: all
+CODE:
+object ApiClient {
+    private const val API_KEY = "sk-live-a1b2c3d4e5f6g7h8i9j0"
+    private const val BASE_URL = "http://api.example.com/"
+
+    fun create(): Retrofit {
+        val client = OkHttpClient.Builder()
+            .addInterceptor { chain ->
+                chain.proceed(chain.request().newBuilder()
+                    .addHeader("X-API-Key", API_KEY).build())
+            }.build()
+        return Retrofit.Builder().baseUrl(BASE_URL).client(client).build()
+    }
+}
+```
+
+### Output
+
+```
+SENTINEL REPORT
+===============
+File: data/remote/ApiClient.kt
+Platform: Android
+Focus: all
+Vulnerabilities Found: 2
+Critical: 2  High: 0  Medium: 0  Low: 0
+
+FINDINGS (ranked by severity)
+------------------------------
+[CRITICAL] M9 Reverse Engineering — Hardcoded live API key
+  Location    : Line 2 — API_KEY constant
+  Attack Path : Run `apktool d app.apk`, then `grep -r "sk-live"`. The key is
+                readable in 30 seconds with no reverse engineering skill. The
+                "sk-live-" prefix indicates a production credential — an attacker
+                can make authenticated API calls at the owner's expense or read
+                user data immediately.
+  Fix         :
+  ```kotlin
+  // Never store live API keys in the binary.
+  // Option A: Fetch the key from your backend after authentication.
+  // Option B: For non-critical keys, use local.properties (git-ignored):
+  // local.properties → API_KEY=sk-live-...
+  // build.gradle.kts → buildConfigField("String", "API_KEY", ...)
+  // Note: BuildConfig fields are still extractable — rotate this key immediately.
+  ```
+
+[CRITICAL] M3 Insecure Communication — HTTP base URL
+  Location    : Line 3 — BASE_URL = "http://..."
+  Attack Path : On any shared network (coffee shop WiFi, hotel network), an attacker
+                running a passive sniffer captures all API traffic including the
+                X-API-Key header in every request. No special tooling needed — Wireshark
+                in 5 minutes exposes every user's data and the API credential.
+  Fix         :
+  ```kotlin
+  private const val BASE_URL = "https://api.example.com/"
+  // Add certificate pinning:
+  val client = OkHttpClient.Builder()
+      .certificatePinner(CertificatePinner.Builder()
+          .add("api.example.com", "sha256/YOUR_PIN_HERE").build())
+      .build()
+  ```
+
+OWASP COVERAGE
+--------------
+M1 Improper Platform Usage    : Not applicable
+M2 Insecure Data Storage      : Not applicable (no storage code)
+M3 Insecure Communication     : Checked — CRITICAL (HTTP)
+M4 Insecure Authentication    : Checked — hardcoded key impacts auth
+M5 Insufficient Cryptography  : Not applicable
+M6 Insecure Authorization     : Not applicable
+M7 Client Code Quality        : Not applicable
+M8 Code Tampering             : Not applicable
+M9 Reverse Engineering        : Checked — CRITICAL (hardcoded key)
+M10 Extraneous Functionality  : Not applicable
+
+NEXT STEPS
+----------
+1. Rotate the sk-live-* key immediately — it is compromised by being in git history.
+2. Switch BASE_URL to HTTPS and add OkHttp CertificatePinner.
+3. Add truffleHog or gitleaks to CI to prevent future secret commits.
+```
+
+---
+
+## Notes
+
+- Rotate any exposed credentials before remediating — assume they are already compromised.
+- This agent scans source code only. Complement with dynamic analysis (MobSF, Frida, Burp Suite).
+- Tested with: Claude Sonnet 4.6.

package/agents/cross-platform/store-listing-writer/README.md

@@ -0,0 +1,58 @@
+# Store Listing Writer Agent
+
+> Describe your app. Get fully ASO-optimized App Store and Google Play Store listings — title, subtitle, description, keywords, and What's New — with character counts and keyword density analysis.
+
+---
+
+## What This Agent Does
+
+Writes App Store and Google Play Store listings from a brief product description:
+
+- **App Store** — Title (30 chars), Subtitle (30 chars), Description (4,000 chars), Keywords (100 chars), What's New
+- **Play Store** — Title (30 chars), Short Description (80 chars), Full Description (4,000 chars)
+- **ASO analysis** — primary keyword placement, density check, competitor gap notes, A/B test suggestions
+
+Every output respects Apple and Google's restrictions: no superlatives ("best", "#1"), no pricing, no competitor mentions.
+
+---
+
+## Files
+
+| File | Purpose |
+|---|---|
+| [`agent.md`](agent.md) | Input format, output format, full system prompt |
+| [`example-input.md`](example-input.md) | Taskly productivity app description |
+| [`example-output.md`](example-output.md) | Complete App Store + Play Store listings |
+
+---
+
+## Quick Start
+
+```
+APP_NAME: <Your App>
+STORE: <app-store | play-store | both>
+CATEGORY: <App category>
+TARGET_AUDIENCE: <Who uses this>
+CORE_FEATURES:
+- Feature 1
+- Feature 2
+TONE: <professional | friendly | playful | minimal>
+```
+
+---
+
+## Character Limit Reference
+
+| Field | App Store | Play Store |
+|---|---|---|
+| Title | 30 | 30 |
+| Subtitle / Short Description | 30 | 80 |
+| Description | 4,000 | 4,000 |
+| Keywords (App Store only) | 100 | N/A |
+
+---
+
+## Related Agents
+
+- [`agents/cross-platform/release-notes-generator`](../release-notes-generator/) — generate the "What's New" section from git commits
+- `prompts/android/gradle-dependency-audit.md` — ensure the app is ship-ready before writing the listing