mobile-ai-agents 1.0.23

package/skills/cross-platform/prd-verification.md

@@ -0,0 +1,324 @@
+# Skill — /prd-verification
+
+**Platform:** Android / iOS / Flutter / React Native / Kotlin Multiplatform / Unity / Unreal  
+**Slash Command:** `/prd-verification`  
+**Composable With:** MOBILE-HARNESS, APPFORGE, Mobile Memory, `/mobile-mcp-qa`, `/clean-code-audit`, `/security-audit`, `/accessibility-audit`
+
+---
+
+## Purpose
+
+Verify that an implemented app or feature matches the approved PRD, design plan, task acceptance criteria, tests, screenshots, and project memory.
+
+Use this after implementation and before marking a task complete. This skill is evidence-based: it verifies against documents and artifacts, not conversation memory.
+
+---
+
+## Input Format
+
+```text
+COMMAND: /prd-verification
+PLATFORM: <Android | iOS | Flutter | React Native | KMP | Unity | Unreal>
+FEATURE_OR_SCOPE:
+<feature name, task id, release scope, or app area>
+DOCUMENTS:
+<PRD.md, DESIGN.md, TASKS.md, DEPENDENCIES.md, ROADMAP.md, MOBILE_MEMORY.md excerpts or paths>
+IMPLEMENTATION:
+<changed files, relevant source code, repo tree, or diff>
+EVIDENCE:
+<test output, build output, screenshots, Mobile MCP QA report, logs, accessibility report, security report>
+KNOWN_LIMITATIONS:
+<optional explicit constraints, skipped checks, unavailable device, unavailable backend>
+```
+
+---
+
+## Skill Prompt
+
+```text
+Run PRD verification for the provided mobile app or feature scope.
+
+Your job is to decide whether the implementation matches the approved product documents and available evidence.
+
+Read these inputs in order:
+
+1. PRD.md or product requirements
+2. TASKS.md acceptance criteria
+3. DESIGN.md or design plan
+4. DEPENDENCIES.md and ROADMAP.md when provided
+5. MOBILE_MEMORY.md or project context when provided
+6. Relevant source code, diff, and file tree
+7. Test/build output
+8. Screenshots, videos, accessibility reports, security reports, or Mobile MCP QA reports
+
+Verification rules:
+
+- Verify against written artifacts, not memory.
+- Every PASS or FAIL must cite a source and evidence.
+- If a requirement exists in the PRD but no implementation evidence is provided, mark it UNKNOWN, not PASS.
+- If implementation contradicts the PRD, mark FAIL.
+- If behavior is inferred from code but not tested, mark PARTIAL and explain the missing proof.
+- Separate confirmed gaps from assumptions.
+- Do not expand scope beyond the approved PRD unless it creates release risk.
+- Do not mark release-ready if critical requirements, security blockers, crash risks, or required tests are missing.
+
+Check these areas:
+
+1. FEATURE COVERAGE
+- Core features listed in PRD.
+- MVP vs future feature boundaries.
+- Required user flows and edge cases.
+- Offline, restart, error, loading, and empty states when specified.
+
+2. ACCEPTANCE CRITERIA
+- Every task acceptance criterion.
+- QA checklist items.
+- Functional requirements and non-functional requirements.
+- Analytics, permissions, notifications, subscriptions, ads, or API behavior when specified.
+
+3. DESIGN AND UI MATCH
+- Screen list and navigation match the design plan.
+- Layout, hierarchy, content, states, responsiveness, and accessibility evidence.
+- Screenshot or Mobile MCP evidence when available.
+
+4. TEST AND DEVICE EVIDENCE
+- Unit, integration, UI, golden/snapshot, E2E, and manual QA evidence.
+- Build/install/launch proof.
+- Device, emulator, simulator, or Mobile MCP proof when available.
+
+5. SECURITY AND RELEASE BLOCKERS
+- Security audit findings that affect release.
+- Sensitive data, auth, storage, network, permissions, deep links, WebViews, logging, and payment/subscription behavior when relevant.
+- Performance blockers that affect launch readiness.
+
+6. CONTEXT CONTINUITY
+- MOBILE_MEMORY.md or project context reflects the current state.
+- Remaining gaps and next action are captured for future sessions.
+
+Output exactly:
+
+Table formatting rules:
+- Output normal Markdown. Do not wrap the final report in a fenced code block.
+- Keep every table cell short, ideally under 8 words.
+- Do not put full paragraphs, logs, code blocks, screenshots, or multi-sentence explanations inside table cells.
+- Put long evidence and reasoning in `Verification Details`.
+- Use stable IDs (`PRD-001`, `PRD-002`) to connect summary rows to detail sections.
+
+PRD MATCH REPORT
+================
+Platform:
+Feature/Scope:
+Result: PASS | FAIL | PARTIAL | BLOCKED
+Documents Read:
+Evidence Reviewed:
+
+Executive Summary:
+- <short status summary>
+
+Feature Coverage:
+| ID | Requirement | Source | Status | Evidence |
+|---|---|---|---|---|
+
+Acceptance Criteria Status:
+| ID | Criteria | Source | Status | Evidence |
+|---|---|---|---|---|
+
+UI Match:
+| Screen/State | Source | Status | Evidence |
+|---|---|---|---|
+
+Test And Device Evidence:
+| Check | Status | Evidence |
+|---|---|---|
+
+Security And Release Blockers:
+| ID | Blocker | Source | Status | Action |
+|---|---|---|---|---|
+
+Verification Details:
+### PRD-001 — <short title>
+- Source:
+- Evidence:
+- Status:
+- Confirmed gap:
+- Assumption:
+- Required fix:
+
+Missing Requirements:
+- <requirement or "None">
+
+Confirmed Gaps:
+- <gap or "None">
+
+Assumptions:
+- <assumption or "None">
+
+Test Gaps:
+- <gap or "None">
+
+Release Readiness:
+PASS only if all required PRD items and acceptance criteria are PASS, no critical UI/security/test gaps remain, and unknowns are documented or risk-accepted.
+
+Next Action:
+1. <single highest priority action>
+```
+
+---
+
+## Example
+
+### Input
+
+```text
+COMMAND: /prd-verification
+PLATFORM: Android
+FEATURE_OR_SCOPE: Habit Pulse MVP
+DOCUMENTS:
+PRD.md:
+- Users can view today's habits.
+- Users can add a habit with a name.
+- Users can mark a habit complete.
+- Habits persist after app restart.
+- MVP includes Home, Add Habit, History, and Settings screens.
+
+TASKS.md:
+- T1 Home list: default seeded habits visible.
+- T2 Add habit: Save disabled until name is non-empty.
+- T3 Persistence: saved habits survive restart.
+
+DESIGN.md:
+- Polished consumer direction.
+- Four screens required: Home, Add Habit, History, Settings.
+- Empty, populated, and validation states required.
+
+IMPLEMENTATION:
+- MainActivity.kt renders HomeScreen with two seeded habits.
+- AddHabitDialog validates empty name and appends to in-memory list.
+- No datastore, database, or preferences files.
+- No HistoryScreen or SettingsScreen files.
+
+EVIDENCE:
+- Build PASS.
+- Screenshot shows Home with two habits.
+- Screenshot shows Add Habit dialog.
+- No restart test output.
+- No Mobile MCP report.
+```
+
+### Output
+
+```text
+PRD MATCH REPORT
+================
+Platform: Android
+Feature/Scope: Habit Pulse MVP
+Result: FAIL
+Documents Read: PRD.md, TASKS.md, DESIGN.md
+Evidence Reviewed: build output, screenshots, source notes
+
+Executive Summary:
+- MVP is not PRD-complete because persistence, History, Settings, and device proof are missing.
+
+Feature Coverage:
+| ID | Requirement | Source | Status | Evidence |
+|---|---|---|---|---|
+| PRD-001 | View today's habits | PRD.md | PASS | Home screenshot |
+| PRD-002 | Add habit | PRD.md | PARTIAL | Dialog screenshot |
+| PRD-003 | Mark complete | PRD.md | UNKNOWN | No interaction proof |
+| PRD-004 | Persist after restart | PRD.md | FAIL | In-memory state |
+| PRD-005 | Four MVP screens | DESIGN.md | FAIL | Two screens only |
+
+Acceptance Criteria Status:
+| ID | Criteria | Source | Status | Evidence |
+|---|---|---|---|---|
+| AC-001 | Seeded habits visible | TASKS.md T1 | PASS | Home screenshot |
+| AC-002 | Save disabled empty | TASKS.md T2 | PARTIAL | Code notes |
+| AC-003 | Survives restart | TASKS.md T3 | FAIL | No storage layer |
+
+UI Match:
+| Screen/State | Source | Status | Evidence |
+|---|---|---|---|
+| Home populated | DESIGN.md | PASS | Screenshot |
+| Add validation | DESIGN.md | PARTIAL | Dialog screenshot |
+| History screen | DESIGN.md | FAIL | Missing file |
+| Settings screen | DESIGN.md | FAIL | Missing file |
+
+Test And Device Evidence:
+| Check | Status | Evidence |
+|---|---|---|
+| Build | PASS | Build output |
+| Restart test | FAIL | No test |
+| Device QA | UNKNOWN | No Mobile MCP report |
+
+Security And Release Blockers:
+| ID | Blocker | Source | Status | Action |
+|---|---|---|---|---|
+| REL-001 | Persistence missing | PRD.md | FAIL | Add storage |
+
+Verification Details:
+### PRD-004 — Habits do not persist after restart
+- Source: PRD.md persistence requirement and TASKS.md T3.
+- Evidence: Implementation uses in-memory list and no datastore, database, or preferences files are present.
+- Status: FAIL.
+- Confirmed gap: Saved habits are lost on app restart.
+- Assumption: None.
+- Required fix: Add local persistence and restart verification.
+
+### PRD-005 — Required MVP screens are missing
+- Source: DESIGN.md screen list.
+- Evidence: No HistoryScreen or SettingsScreen implementation was provided.
+- Status: FAIL.
+- Confirmed gap: The delivered app has fewer screens than the approved MVP design.
+- Assumption: None.
+- Required fix: Implement History and Settings or update approved scope.
+
+Missing Requirements:
+- Habit persistence after restart.
+- History screen.
+- Settings screen.
+- Device QA evidence.
+
+Confirmed Gaps:
+- Storage layer is missing.
+- Two approved screens are missing.
+
+Assumptions:
+- Mark-complete behavior may exist, but no interaction evidence was provided.
+
+Test Gaps:
+- Restart persistence test.
+- UI test for add habit validation.
+- Mobile MCP device flow.
+
+Release Readiness:
+PASS only if all required PRD items and acceptance criteria are PASS, no critical UI/security/test gaps remain, and unknowns are documented or risk-accepted.
+
+Next Action:
+1. Implement persistence and restart verification before adding new scope.
+```
+
+---
+
+## Composition Example
+
+```text
+Inside MOBILE-HARNESS:
+1. Implement the current task.
+2. Run tests and collect screenshots or Mobile MCP QA.
+3. Run /prd-verification with PRD.md, DESIGN.md, TASKS.md, MOBILE_MEMORY.md, code diff, and evidence.
+4. Mark the task complete only if /prd-verification returns PASS or accepted PARTIAL with documented exceptions.
+5. Save the report summary into MOBILE_MEMORY.md.
+```
+
+```text
+Inside APPFORGE:
+Use /prd-verification during Stage 5 and Stage 7 to compare implementation output against the approved PRD, design plan, and task acceptance criteria before Play Store preparation.
+```
+
+---
+
+## Notes
+
+- This skill does not replace tests or device QA. It checks whether the available evidence proves the product requirements.
+- UNKNOWN is safer than PASS when evidence is missing.
+- PARTIAL is allowed only when implementation evidence exists but proof is incomplete.

package/skills/cross-platform/release-prep.md

@@ -0,0 +1,64 @@
+# Skill — /release-prep
+
+**Platform:** Cross-Platform
+**Slash Command:** `/release-prep`
+**Composable With:** agents/cross-platform/scribe/agent.md, agents/cross-platform/pipeline/agent.md
+
+---
+
+## Purpose
+
+Full release checklist from feature freeze to store submission. Replaces 20 Confluence pages. Adapts to Android, iOS, Flutter, or React Native.
+
+---
+
+## Skill Prompt
+
+```
+Run the mobile release checklist for the provided platform and version:
+
+PRE-RELEASE (Feature Freeze → Branch Cut)
+[ ] Version code / build number incremented
+[ ] Version name updated (semantic versioning: MAJOR.MINOR.PATCH)
+[ ] Release branch cut from main/develop
+[ ] All feature flags for this release enabled/disabled correctly
+[ ] CHANGELOG updated with this version's changes
+[ ] Third-party SDK versions audited for known CVEs
+
+BUILD QUALITY
+[ ] All CI checks passing on release branch (lint, tests, build)
+[ ] No CRITICAL or HIGH severity issues from security scan (SENTINEL)
+[ ] Performance baseline measured and no regressions > 5% from previous release
+[ ] Crash-free rate from previous version noted (baseline for this release)
+[ ] ProGuard/R8 mapping file backed up (Android)
+[ ] Debug symbols uploaded (dSYM for iOS, mapping.txt for Android → Firebase/Sentry)
+
+STORE PREPARATION
+[ ] Store listing updated if features changed (screenshots, description)
+[ ] Release notes written for both stores (SCRIBE)
+[ ] App Store review notes prepared (if new permissions or flows)
+[ ] Age rating correct for new content (if applicable)
+[ ] Privacy policy updated if new data collection added
+
+ANDROID SPECIFIC
+[ ] targetSdkVersion up to date (Google requires current year's target SDK by August)
+[ ] Adaptive icon tested on Android 8+ devices
+[ ] 64-bit APK / AAB includes both ARM64 and x86_64
+[ ] Play App Signing enrolled
+[ ] Internal testing → Closed testing → Open testing → Production rollout plan set
+
+iOS SPECIFIC
+[ ] All required privacy usage description strings in Info.plist
+[ ] App Transport Security exceptions justified
+[ ] In-app purchase products reviewed if applicable
+[ ] TestFlight beta distributed to testers, feedback collected
+[ ] Notarization complete (macOS if applicable)
+
+ROLLOUT STRATEGY
+[ ] Staged rollout planned: 1% → 5% → 20% → 100%
+[ ] Monitoring dashboard ready (Firebase, Crashlytics, Sentry)
+[ ] Rollback plan documented: which version to roll back to and how
+[ ] On-call engineer assigned for first 48 hours post-launch
+
+Flag any unchecked items as blockers before submission.
+```

package/skills/cross-platform/security-audit.md

@@ -0,0 +1,281 @@
+# Skill — /security-audit
+
+**Platform:** Android / iOS / Flutter / React Native  
+**Slash Command:** `/security-audit`  
+**Composable With:** SENTINEL, agents/cross-platform/security-scanner/agent.md, MOBILE-HARNESS, APPFORGE
+
+---
+
+## Purpose
+
+Run a complete mobile app security audit across code, configuration, storage, networking, authentication, permissions, build settings, logging, WebViews, deep links, dependencies, and release readiness.
+
+Use this when the user wants more than a quick code scan. This skill is intended for app-wide pre-release review and should be paired with SENTINEL or `security-scanner` for detailed exploit analysis.
+
+---
+
+## Input Format
+
+```text
+COMMAND: /security-audit
+PLATFORM: <Android | iOS | Flutter | React Native>
+APP_TYPE: <consumer | fintech | health | enterprise | game | other>
+SCOPE:
+<repo tree, changed files, manifests, config files, auth/storage/network files>
+DATA_HANDLED:
+<tokens, PII, payments, health, location, files, messages, analytics>
+CODE_OR_FINDINGS:
+<paste code, config, dependency list, or previous scan output>
+```
+
+---
+
+## Skill Prompt
+
+```text
+Run a complete app security audit for the provided mobile app scope.
+
+Use OWASP Mobile Top 10 as the baseline, but also check platform release risks.
+
+Audit these areas:
+
+1. DATA CLASSIFICATION AND THREAT MODEL
+- Identify sensitive data: credentials, tokens, PII, payment data, health data, precise location, contacts, messages, photos, files, analytics identifiers.
+- Identify trust boundaries: app, backend, third-party SDKs, WebViews, deep links, push notifications, local storage, clipboard, logs.
+- If data classification is missing, infer it from the code and mark assumptions.
+
+2. SECRETS AND CREDENTIALS
+- No API keys, tokens, passwords, client secrets, private keys, signing configs, keystore passwords, or service account JSON in source.
+- Check Android Gradle files, BuildConfig, string resources, google-services files, local.properties misuse, CI files.
+- Check iOS Info.plist, .xcconfig, entitlements, project files, Swift constants.
+- Check Flutter .env assets, Dart constants, Android/iOS folders.
+- Check React Native JS bundles, env files, native config, Metro output risk.
+
+3. STORAGE SECURITY
+- Tokens and credentials must use Keychain, EncryptedSharedPreferences, Android Keystore, Secure Enclave where appropriate, expo-secure-store, or react-native-keychain.
+- AsyncStorage, SharedPreferences, UserDefaults, plain SQLite, files, cache, logs, and clipboard must not hold secrets.
+- Sensitive databases need encryption or documented risk acceptance.
+- Backup behavior must be safe: Android allowBackup/dataExtractionRules and iOS backup exclusions for sensitive files.
+
+4. NETWORK AND TRANSPORT
+- HTTPS required for production APIs.
+- No cleartext traffic unless explicitly justified for local/dev and blocked in release.
+- TLS validation must not be disabled.
+- Certificate pinning required for high-risk auth, payment, health, or enterprise apps.
+- No permissive TrustManager, HostnameVerifier, URLSession delegate, ATS exception, or debug proxy config in release.
+- API errors must not leak secrets.
+
+5. AUTHENTICATION AND SESSION MANAGEMENT
+- Tokens expire and refresh safely.
+- Logout clears local sensitive data.
+- Biometric/PIN gates protect highly sensitive local data when required.
+- No credentials in URLs.
+- No weak password reset, magic link, or OTP handling in app code.
+- Session state is not stored in globally mutable objects without lifecycle handling.
+
+6. AUTHORIZATION AND BUSINESS LOGIC
+- Client does not enforce critical authorization alone.
+- Feature flags, premium/subscription checks, admin flags, and role checks must be validated server-side.
+- Local tampering must not unlock paid or privileged behavior.
+
+7. INPUT VALIDATION, DEEP LINKS, AND IPC
+- Deep links validate scheme, host, path, parameters, and auth state before navigation.
+- Android exported activities/services/receivers are minimal and protected.
+- iOS URL schemes/universal links validate allowed hosts and paths.
+- Push notification payloads are validated before navigation or data mutation.
+- File imports, intents, document pickers, and share extensions validate size, type, and path.
+
+8. WEBVIEW AND JAVASCRIPT BRIDGES
+- WebViews load only trusted origins.
+- JavaScript bridges are disabled unless strictly required and origin-gated.
+- File access, universal file URL access, mixed content, and arbitrary navigation are blocked.
+- User-controlled input is never passed directly into evaluateJavaScript/loadUrl.
+
+9. LOGGING, ANALYTICS, AND PRIVACY
+- No tokens, passwords, OTPs, PII, payment data, or health data in logs, crashes, analytics, breadcrumbs, or screenshots.
+- Debug logging disabled in release.
+- Privacy policy and app store data safety declarations match actual SDK/data behavior.
+- Third-party SDKs are reviewed for data collection.
+
+10. DEPENDENCIES AND SUPPLY CHAIN
+- Identify outdated, vulnerable, abandoned, or risky dependencies.
+- Check dependency pinning, lockfiles, Gradle plugins, CocoaPods/SPM, npm packages, Flutter packages.
+- Flag dynamic code loading, remote config executing logic, reflection/plugin loading risk.
+
+11. PLATFORM HARDENING
+- Android: release debuggable false, minify/shrink where appropriate, signing config protected, exported components explicit, backup rules safe, network security config release-safe.
+- iOS: ATS enabled, Keychain access groups correct, entitlements minimal, jailbreak-sensitive apps document protections, release builds do not enable debug menus.
+- Flutter: native Android/iOS configs audited too, not only Dart.
+- React Native: JS bundle secrets checked, dev menu disabled in release, native configs audited too.
+
+12. RELEASE GATE
+- Map findings to OWASP Mobile Top 10 where possible.
+- Assign severity: CRITICAL, HIGH, MEDIUM, LOW, INFO.
+- Include exploit scenario and concrete fix.
+- State what could not be verified from provided files.
+
+Output exactly:
+
+Table formatting rules:
+- Output normal Markdown. Do not wrap the final report in a fenced code block.
+- Keep every table cell short, ideally under 8 words.
+- Do not put full paragraphs, logs, stack traces, secrets, or multi-sentence fixes inside table cells.
+- Put long evidence, exploit scenarios, and fixes in `Finding Details`.
+- Use stable IDs (`SEC-001`, `SEC-002`) to connect summary rows to detail sections.
+
+MOBILE SECURITY AUDIT REPORT
+============================
+Platform:
+App Type:
+Data Handled:
+Result: PASS | FAIL | BLOCKED
+
+Executive Summary:
+- <short risk summary>
+
+Findings Summary:
+| ID | Severity | OWASP | Area | Evidence | Fix Summary |
+|---|---|---|---|---|---|
+
+Finding Details:
+### SEC-001 — <short title>
+- Severity:
+- OWASP:
+- Area:
+- Evidence:
+- Exploit Scenario:
+- Fix:
+- Verification:
+
+Security Checklist:
+| Area | Status | Notes |
+|---|---|---|
+| Secrets | PASS/FAIL/UNKNOWN | |
+| Storage | PASS/FAIL/UNKNOWN | |
+| Network/TLS | PASS/FAIL/UNKNOWN | |
+| Auth/Session | PASS/FAIL/UNKNOWN | |
+| Authorization | PASS/FAIL/UNKNOWN | |
+| Deep Links/IPC | PASS/FAIL/UNKNOWN | |
+| WebView | PASS/FAIL/UNKNOWN | |
+| Logging/Analytics | PASS/FAIL/UNKNOWN | |
+| Dependencies | PASS/FAIL/UNKNOWN | |
+| Platform Hardening | PASS/FAIL/UNKNOWN | |
+| Privacy/Store Data Safety | PASS/FAIL/UNKNOWN | |
+
+Files Needed For Complete Audit:
+- <file or "None">
+
+Release Gate:
+PASS only if no CRITICAL or HIGH findings remain, and UNKNOWN items are either verified or explicitly risk-accepted.
+
+Next Actions:
+1. <highest priority fix>
+2. <next fix>
+3. <next fix>
+```
+
+---
+
+## Example
+
+### Input
+
+```text
+COMMAND: /security-audit
+PLATFORM: Android
+APP_TYPE: consumer finance
+DATA_HANDLED: auth tokens, payment history, email, phone
+CODE_OR_FINDINGS:
+- AndroidManifest has android:debuggable="true"
+- network_security_config permits cleartextTrafficPermitted="true"
+- TokenRepository stores auth_token in SharedPreferences
+```
+
+### Output
+
+```text
+MOBILE SECURITY AUDIT REPORT
+============================
+Platform: Android
+App Type: consumer finance
+Data Handled: auth tokens, payment history, email, phone
+Result: FAIL
+
+Executive Summary:
+- Release is blocked by plaintext token storage, release debugging, and cleartext network policy.
+
+Findings Summary:
+| ID | Severity | OWASP | Area | Evidence | Fix Summary |
+|---|---|---|---|---|---|
+| SEC-001 | CRITICAL | M2 | Storage | Token in SharedPreferences | Use encrypted token storage |
+| SEC-002 | CRITICAL | M8 | Platform Hardening | Release debuggable true | Disable release debugging |
+| SEC-003 | HIGH | M3 | Network/TLS | Cleartext allowed | Disable cleartext in release |
+
+Finding Details:
+### SEC-001 — Auth token stored in plaintext preferences
+- Severity: CRITICAL
+- OWASP: M2 Insecure Data Storage
+- Area: Storage
+- Evidence: `auth_token` is stored in `SharedPreferences`.
+- Exploit Scenario: Device compromise, root access, or debug backup can expose session tokens.
+- Fix: Store tokens in `EncryptedSharedPreferences` backed by Android Keystore.
+- Verification: Confirm token writes use encrypted storage and logout clears the encrypted value.
+
+### SEC-002 — Release build is debuggable
+- Severity: CRITICAL
+- OWASP: M8 Security Misconfiguration
+- Area: Platform Hardening
+- Evidence: `android:debuggable="true"`.
+- Exploit Scenario: Attackers can attach a debugger to the release app and inspect runtime state.
+- Fix: Ensure release builds set `debuggable false` and remove debug-only menus.
+- Verification: Inspect merged release manifest and release APK flags.
+
+### SEC-003 — Cleartext traffic allowed
+- Severity: HIGH
+- OWASP: M3 Insecure Communication
+- Area: Network/TLS
+- Evidence: `cleartextTrafficPermitted="true"`.
+- Exploit Scenario: Traffic can be intercepted or modified on hostile networks.
+- Fix: Disable cleartext in release network security config.
+- Verification: Confirm release config blocks HTTP endpoints and test API calls over HTTPS only.
+
+Security Checklist:
+| Area | Status | Notes |
+|---|---|---|
+| Secrets | UNKNOWN | Gradle and CI files not provided |
+| Storage | FAIL | Token stored in plaintext |
+| Network/TLS | FAIL | Cleartext enabled |
+| Auth/Session | UNKNOWN | Refresh/logout code not provided |
+| Authorization | UNKNOWN | Server-side checks not provided |
+| Deep Links/IPC | UNKNOWN | Manifest intent filters not fully provided |
+| WebView | UNKNOWN | No WebView files provided |
+| Logging/Analytics | UNKNOWN | Logging files not provided |
+| Dependencies | UNKNOWN | Dependency lockfiles not provided |
+| Platform Hardening | FAIL | Debuggable release |
+| Privacy/Store Data Safety | UNKNOWN | Store declarations not provided |
+
+Files Needed For Complete Audit:
+- app/build.gradle
+- AndroidManifest.xml
+- network_security_config.xml
+- TokenRepository
+- dependency lockfile
+- logging and analytics wrappers
+
+Release Gate:
+PASS only if no CRITICAL or HIGH findings remain, and UNKNOWN items are either verified or explicitly risk-accepted.
+
+Next Actions:
+1. Move auth token storage to EncryptedSharedPreferences.
+2. Disable release debugging and cleartext traffic.
+3. Provide Gradle, manifest, dependency, auth, and logging files for full verification.
+```
+
+---
+
+## Usage Notes
+
+- Use `/security-scan` for quick inline code review.
+- Use `/security-audit` for app-wide release gates.
+- Pair with SENTINEL or `agents/cross-platform/security-scanner/agent.md` when exploitability analysis and OWASP evidence need to be deeper.
+- Inside MOBILE-HARNESS, run this before launch prep and whenever auth, payments, storage, deep links, or WebViews change.