mobile-ai-agents 1.0.23

package/skills/shared/security-scan.md

@@ -0,0 +1,149 @@
+# Skill — Mobile Security Scan
+
+**Platform:** Cross-Platform (Android / iOS / Flutter / React Native)  
+**Category:** Code Quality / Security  
+**Composable With:** agents/cross-platform/security-scanner/agent.md
+
+---
+
+## Purpose
+
+Reviews mobile source code for the most exploitable OWASP Mobile Top 10 vulnerabilities. Use as a pre-release security gate or as part of a code review for security-sensitive features (auth, payments, deep links).
+
+## When to Use
+
+- Before any release that touches auth, payments, or data storage
+- When reviewing code that handles user credentials or tokens
+- When adding a new deep link or URL scheme handler
+
+---
+
+## Skill Prompt
+
+```
+When scanning mobile code for security vulnerabilities, check for:
+
+HARDCODED SECRETS (M9 — Insecure Authentication)
+- API keys, tokens, passwords, or cryptographic keys hardcoded as string literals.
+  Common patterns: const val API_KEY = "sk-...", let apiKey = "Bearer ...", "password123"
+- Android: check BuildConfig fields, string resources, and gradle.properties committed to git.
+- iOS: check Info.plist, .xcconfig files, and Swift/ObjC string constants.
+- Fix: use environment variables, secrets managers (AWS Secrets Manager, HashiCorp Vault),
+  or runtime fetching from a secure endpoint. Never commit secrets to git.
+- Severity: CRITICAL
+
+INSECURE DATA STORAGE (M2)
+- Android SharedPreferences storing tokens, passwords, PII, or session IDs in clear text.
+  Fix: use EncryptedSharedPreferences (Jetpack Security Crypto).
+- iOS NSUserDefaults storing tokens or credentials.
+  Fix: use the Keychain (KeychainAccess library, or Security framework directly).
+- SQLite databases storing sensitive data without SQLCipher encryption.
+- Files written to external storage (Environment.EXTERNAL_STORAGE_DIR) with sensitive content.
+- React Native AsyncStorage storing tokens in clear text — AsyncStorage is unencrypted.
+  Fix: use react-native-keychain or expo-secure-store.
+- Severity: CRITICAL for tokens/passwords, HIGH for PII
+
+UNVALIDATED DEEP LINKS / URL SCHEMES (M10 — Insufficient Input/Output Validation)
+- Deep link handlers that read query parameters and use them directly in navigation,
+  SQL queries, or web view URLs without validation or sanitization.
+- Android intent-filter handlers that accept arbitrary schemes without host/path validation.
+- iOS Universal Links and Custom URL Scheme handlers that don't validate the source or
+  whitelist allowed paths.
+- Fix: whitelist allowed hosts and paths; sanitize all URL parameters before use;
+  never pass raw URL parameters to a WebView loadUrl() or SQL query.
+- Severity: HIGH
+
+MISSING CERTIFICATE PINNING (M3 — Insecure Communication)
+- Apps that handle financial data, health data, or authentication without certificate pinning
+  are vulnerable to MitM attacks on hostile networks (coffee shops, corporate proxies).
+- Android: check for TrustManager implementations that override checkServerTrusted() without
+  real validation — this defeats TLS entirely.
+- iOS: check for NSAllowsArbitraryLoads: true in Info.plist — this disables ATS globally.
+- Fix (Android): use OkHttp CertificatePinner or Network Security Config XML.
+- Fix (iOS): implement URLSessionDelegate.urlSession(_:didReceive:completionHandler:) with
+  pinned certificate fingerprint validation.
+- Severity: HIGH for auth/payment endpoints, MEDIUM otherwise
+
+INSECURE WEBVIEW CONFIGURATION (M1 — Improper Platform Usage)
+- Android WebView: setJavaScriptEnabled(true) with addJavascriptInterface() exposes a Java
+  bridge to any JS running in the WebView. If the WebView loads untrusted content, this is RCE.
+- Android WebView: setAllowFileAccessFromFileURLs(true) allows file:// URLs to read other files.
+- iOS WKWebView: evaluateJavaScript with user-controlled input is XSS.
+- Fix: never load untrusted URLs in a WebView with JS enabled + native bridge.
+  Use a Content Security Policy. Whitelist allowed origins.
+- Severity: CRITICAL if loading untrusted content, HIGH otherwise
+
+EXCESSIVE PERMISSIONS (M1)
+- Android manifest permissions that are not required by the app's features.
+  Common over-grants: READ_CONTACTS, ACCESS_FINE_LOCATION, RECORD_AUDIO, CAMERA
+  when the feature only needs ACCESS_COARSE_LOCATION or doesn't use the camera.
+- iOS Info.plist usage description strings that are overly broad ("App needs location")
+  rather than specific and accurate.
+- Fix: request only the minimum permission needed; use ACCESS_COARSE_LOCATION for maps,
+  ACCESS_FINE_LOCATION only for navigation.
+- Severity: MEDIUM
+
+WEAK OR MISSING CRYPTOGRAPHY (M5)
+- MD5 or SHA-1 used for password hashing or token signing — these are broken for security.
+  Fix: use bcrypt, Argon2, or SHA-256+ for passwords; HMAC-SHA256 for HMAC.
+- ECB mode AES encryption — deterministic, leaks patterns.
+  Fix: use AES-GCM or AES-CBC with a random IV.
+- Hardcoded encryption keys (covered under HARDCODED SECRETS, but call out if it's a crypto key specifically).
+- Severity: CRITICAL for auth/payment, HIGH otherwise
+
+For each issue: identify the file/line, assign severity (CRITICAL / HIGH / MEDIUM / LOW),
+explain why it's exploitable, and give the concrete fix.
+```
+
+---
+
+## Example
+
+**Input:**
+```kotlin
+// Android — ProfileRepository.kt
+object ProfileRepository {
+    private val prefs = App.context.getSharedPreferences("profile", Context.MODE_PRIVATE)
+
+    fun saveToken(token: String) {
+        prefs.edit().putString("auth_token", token).apply()
+    }
+}
+```
+
+**Output:**
+```
+CRITICAL — Auth token stored in plaintext SharedPreferences
+  Problem: SharedPreferences files are stored at /data/data/<package>/shared_prefs/ and are
+           accessible to any app with root access or via ADB on a debug/unlocked device.
+           Storing auth tokens in plaintext means an attacker with device access can steal
+           session tokens without knowing the user's password.
+  Fix:
+  // Use EncryptedSharedPreferences (requires androidx.security:security-crypto)
+  val masterKey = MasterKey.Builder(context)
+      .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+      .build()
+  val encryptedPrefs = EncryptedSharedPreferences.create(
+      context, "profile_secure", masterKey,
+      EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
+      EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
+  )
+  encryptedPrefs.edit().putString("auth_token", token).apply()
+```
+
+---
+
+## Composition Example
+
+```
+Prepend this skill to any code review that touches auth, storage, deep links, or WebViews.
+For a full structured security audit across an entire codebase with OWASP references
+and a severity-ranked findings report, run agents/cross-platform/security-scanner/agent.md.
+```
+
+---
+
+## Notes
+
+- This skill covers code-level vulnerabilities only. Network-level (TLS configuration, certificate validity), server-side, and binary-level vulnerabilities require dedicated tooling (MobSF, Frida, Burp Suite).
+- Static analysis tools (Android Lint security checks, SwiftLint, Semgrep mobile rules) can automate some of these checks — this skill is for the gaps they miss.

package/skills/unity/README.md

@@ -0,0 +1,31 @@
+# Unity Skills
+
+Reusable skill prompt modules for Unity (HLSL / ShaderLab / URP / HDRP) shader review and game development.
+
+## Index
+
+| Skill | File | When to Use |
+|---|---|---|
+| Unity Shader Review | [shader-review.md](shader-review.md) | Pre-submission mobile shader audit — texture budget, precision, render pipeline correctness |
+
+## Usage
+
+```
+# Review a shader before committing to a mobile build
+[paste skill prompt from shader-review.md]
+
+Review this shader: [paste .shader file content]
+```
+
+## Composable With
+
+- [`agents/unity/shader-generator`](../../agents/unity/shader-generator/) — generate shaders that already follow these rules
+
+## Contributing
+
+High-value skills to add:
+- `unity-c-sharp-patterns.md` — MonoBehaviour patterns, coroutine safety, `Update` vs `FixedUpdate`
+- `mobile-performance.md` — draw call budget, batching, texture atlas, LOD
+- `addressables.md` — Addressable Asset System patterns for mobile memory management
+
+Copy `templates/skill-template.md`.

package/skills/unity/shader-review.md

@@ -0,0 +1,110 @@
+# Skill — Unity Shader Review
+
+**Platform:** Unity (HLSL / ShaderLab)  
+**Category:** Game Development / Performance  
+**Composable With:** agents/unity/shader-generator/agent.md
+
+---
+
+## Purpose
+
+Reviews Unity shader code for mobile performance budget violations, API correctness for the target render pipeline, and common authoring mistakes. Use before shipping a shader to a mobile build.
+
+## When to Use
+
+- Before committing a new shader to a project targeting mobile (iOS/Android)
+- When reviewing a shader generated by an LLM or written by a non-graphics developer
+- When profiling shows GPU overdraw or high fragment shader cost
+
+---
+
+## Skill Prompt
+
+```
+When reviewing a Unity HLSL/ShaderLab shader, check for:
+
+MOBILE PERFORMANCE BUDGET
+- Texture samples: flag if >2 texture samples per fragment on a mobile-targeted shader.
+  Each sample adds GPU latency; 3+ samples per fragment will cause frame budget overruns
+  on Mali/Adreno GPUs at 1080p.
+- Precision: all fragment shader calculations should use half (16-bit) unless the precision
+  is mathematically required to be float (32-bit). Flag any float declaration in the fragment
+  shader that could be half.
+- Dynamic branching: flag any if/else or switch in the fragment shader that depends on a
+  uniform or interpolated value. Dynamic branches cause warp divergence on mobile GPUs.
+  Exception: compile-time branches (#if / #ifdef / shader_feature) are free.
+- pow() and sin(): these are expensive on some GPUs. In the fragment shader, prefer
+  approximations or precomputed lookup textures for non-interactive effects.
+- Discard / clip(): transparent shaders that use discard prevent early-Z culling on mobile.
+  Use alpha blending instead of alpha test where possible.
+
+RENDER PIPELINE CORRECTNESS
+- Built-in Pipeline: must use CGPROGRAM / ENDCG and #include "UnityCG.cginc".
+  Flag any HLSLPROGRAM / URP/HDRP includes in a Built-in shader.
+- URP: must use HLSLPROGRAM / ENDHLSL and include the correct URP ShaderLibrary headers.
+  Flag any CGPROGRAM in a URP shader — it will not compile correctly.
+- HDRP: must use HDRP ShaderLibrary headers and the HDRP attribute struct conventions.
+- Cross-pipeline: if the shader is intended to be pipeline-agnostic, it must use
+  shader_feature or multi_compile to select the correct includes.
+
+COMMON MISTAKES
+- CBUFFER_START(UnityPerMaterial): all material properties that are modified per-material
+  must be inside this constant buffer (URP). Properties outside CBUFFER are GPU-uploaded
+  per-draw-call, which is expensive for batching.
+- Missing FallBack: for Built-in shaders, a FallBack ensures low-end devices render something
+  reasonable. Flag shaders with no FallBack "Diffuse" or FallBack Off without justification.
+- _Time usage: use _Time.y (seconds) for animation. Never use Unity C# Time.deltaTime or
+  Time.time from a shader — these values cannot be passed without a script.
+- ZWrite Off for transparent shaders: additive or alpha-blended shaders must have ZWrite Off
+  to avoid writing to the depth buffer and causing incorrect sorting.
+
+For each issue: identify the line or block, explain the GPU cost or correctness problem,
+and provide the corrected HLSL/ShaderLab snippet.
+```
+
+---
+
+## Example
+
+**Input:**
+```hlsl
+half4 frag(Varyings IN) : SV_Target
+{
+    float4 col = SAMPLE_TEXTURE2D(_MainTex, sampler_MainTex, IN.uv);
+    float4 mask = SAMPLE_TEXTURE2D(_MaskTex, sampler_MaskTex, IN.uv);
+    float4 detail = SAMPLE_TEXTURE2D(_DetailTex, sampler_DetailTex, IN.uv);
+    float brightness = 1.0;
+    if (col.a > 0.5) brightness = 2.0;
+    return col * mask * detail * brightness;
+}
+```
+
+**Output:**
+```
+3 texture samples per fragment — WARNING for mobile
+  Problem: _MainTex, _MaskTex, and _DetailTex are all sampled in the same fragment shader.
+           This hits the recommended mobile budget of ≤2 samples. On Adreno 6xx/Mali-G7x,
+           the third sample adds ~0.5ms per frame at 1080p.
+  Fix: Pack the mask into the alpha channel of _MainTex (RGBA), or bake the detail
+       multiplicatively into _MainTex at import time to eliminate one sample.
+
+Dynamic branch on interpolated value — CRITICAL for mobile
+  Problem: `if (col.a > 0.5)` branches on a sampled texture value. This causes warp
+           divergence on mobile GPUs — both branches execute for every fragment in a warp,
+           wasting half the GPU work.
+  Fix: Use a smooth step or multiply instead:
+  half brightness = 1.0 + step(0.5, col.a);  // 1.0 or 2.0, no branch
+  // Or: half brightness = lerp(1.0, 2.0, step(0.5, col.a));
+
+float4 used for col, mask, detail — WARNING
+  Problem: All three sampled values are float4 (32-bit). For a color/mask that doesn't
+           need full float precision, use half4 to halve ALU register pressure on mobile.
+  Fix: half4 col = SAMPLE_TEXTURE2D(...); half4 mask = ...; half4 detail = ...;
+```
+
+---
+
+## Notes
+
+- GPU profiling (Mali Offline Compiler, Adreno Profiler, Xcode GPU Timeline) is the ground truth — use this skill for pre-submission review, not as a replacement for measuring.
+- For desktop/console shaders, the mobile budget rules (texture count, half precision) do not apply — focus on correctness and pipeline checks instead.

package/templates/agent-template.md

@@ -0,0 +1,88 @@
+# Agent NN — [Agent Name]
+
+**Platform:** [Android | iOS | Flutter | React Native | Unity | Unreal | Cross-Platform]  
+**Category:** [Code Quality | Performance | UI & Design | Debugging | DevOps | Game Dev | Documentation]  
+**Complexity:** [Low | Medium | High]
+
+---
+
+## Purpose
+
+[One sentence: What does this agent do and what problem does it solve?]
+
+---
+
+## Input Format
+
+```
+FIELD_ONE: <description of expected value>
+FIELD_TWO: <description of expected value>
+CONTENT:
+<description of the main content block>
+```
+
+**Fields:**
+
+| Field | Required | Description |
+|---|---|---|
+| `FIELD_ONE` | Yes | [What it is] |
+| `FIELD_TWO` | No | [What it is, and what happens if omitted] |
+| `CONTENT` | Yes | [What goes here] |
+
+---
+
+## Output Format
+
+```
+SECTION HEADING
+===============
+[Describe what appears here]
+
+SECOND SECTION
+--------------
+[Describe what appears here, including any conditional blocks]
+
+VERDICT: <OUTCOME_A | OUTCOME_B | OUTCOME_C>
+```
+
+---
+
+## System Prompt
+
+```
+[This is the full prompt the developer pastes into their LLM session as the system/assistant prompt before submitting input.]
+
+[Write it in second person directed at the LLM: "You are a... Your job is to..."]
+
+[List explicit rules the LLM must follow — numbered, concrete, testable.]
+
+[End with: "Output MUST follow the exact format specified."]
+```
+
+---
+
+## Example
+
+### Input
+
+```
+FIELD_ONE: [example value]
+FIELD_TWO: [example value]
+CONTENT:
+[real example content — not placeholder text]
+```
+
+### Output
+
+```
+[Real example output that the system prompt actually produces on the example input.
+Do not write "Output will appear here." Test it and paste the real result.]
+```
+
+---
+
+## Notes
+
+- [Edge case or limitation 1]
+- [Edge case or limitation 2]
+- [LLM compatibility note, e.g. "Tested with: Claude Sonnet 4.6, GPT-4o"]

package/templates/prompt-template.md

@@ -0,0 +1,50 @@
+# Prompt — [Prompt Name]
+
+**Platform:** [Android | iOS | Flutter | React Native | Unity | Unreal | Cross-Platform]  
+**Category:** [Code Quality | Performance | UI & Design | Debugging | DevOps | Game Dev | Documentation]  
+**Type:** [one-shot | conversational | chain-of-thought]
+
+---
+
+## Purpose
+
+[One sentence: What does this prompt do?]
+
+---
+
+## Prompt
+
+```
+[The raw prompt text. This is a standalone prompt — not a system prompt.
+It is pasted directly into a chat interface along with the developer's content.
+
+Format: clearly separate the instruction from the placeholder for user content.
+Use [CONTENT] or triple backticks to mark where the developer should paste their code/data.]
+```
+
+---
+
+## Example Usage
+
+**What you paste:**
+```
+[Show the full prompt with realistic content substituted in]
+```
+
+**Expected output:**
+```
+[Real output — tested]
+```
+
+---
+
+## Variations
+
+- **[Variation name]:** [Short description of how to modify the prompt for a different use case]
+
+---
+
+## Notes
+
+- [Limitation]
+- [Best LLM for this prompt]

package/templates/skill-template.md

@@ -0,0 +1,64 @@
+# Skill — [Skill Name]
+
+**Platform:** [Android | iOS | Flutter | React Native | Unity | Unreal | Cross-Platform]  
+**Category:** [Code Quality | Performance | UI & Design | Debugging | DevOps | Game Dev | Documentation]  
+**Composable With:** [list other skills this pairs well with, or "standalone"]
+
+---
+
+## Purpose
+
+[One sentence: What reusable capability does this skill add?]
+
+## When to Use
+
+[2–3 bullet points describing the scenarios where you would reach for this skill:
+- When you are doing X and need Y...
+- When an agent needs to...
+- As a step inside a larger workflow when...]
+
+---
+
+## Skill Prompt
+
+```
+[The skill prompt text. This is a self-contained prompt module that can be:
+  (a) Pasted directly into a chat session
+  (b) Prepended to a larger agent prompt
+  (c) Chained with other skills
+
+Write it in second person: "When given X, you will..."
+
+Keep it focused on ONE capability. If it does two things, split it into two skills.]
+```
+
+---
+
+## Example
+
+**Input:**
+```
+[Real example input]
+```
+
+**Output:**
+```
+[Real example output — tested, not hypothetical]
+```
+
+---
+
+## Composition Example
+
+```
+[Show how to combine this skill with another skill or agent.
+Example: "Prepend this skill prompt before the Android Code Reviewer system prompt
+to add layer-boundary detection to the review."]
+```
+
+---
+
+## Notes
+
+- [Limitation or edge case]
+- [Version or API dependency]

package/templates/workflow-template.md

@@ -0,0 +1,48 @@
+# Workflow — [Name]
+
+**Type:** [End-to-end feature | Incident response | Release management | DevOps | UI implementation]
+**Agents Used:** [AGENT-NAME, AGENT-NAME]
+**Skills Used:** [/skill-name, /skill-name]
+
+---
+
+## When to Use
+
+[One sentence: the specific situation that triggers this workflow.]
+
+---
+
+## Steps
+
+```
+1. STEP NAME — AGENT or SKILL
+   ↓ What happens in this step.
+   ↓ What decisions are made.
+   ↓ What output is produced.
+
+2. STEP NAME — AGENT or SKILL
+   ↓ ...
+
+[Continue for each step — typically 4–8 steps]
+```
+
+---
+
+## Inputs
+
+- [What the developer provides at the start]
+- [Required context, files, or access]
+
+---
+
+## Outputs
+
+- [What is produced at the end of this workflow]
+- [Artifacts, deployments, decisions]
+
+---
+
+## Notes
+
+- [Any platform-specific variations]
+- [When NOT to use this workflow]

package/workflows/app-launch.md

@@ -0,0 +1,66 @@
+# Workflow — App Launch
+
+**Type:** Store submission
+**Agents Used:** SENTINEL, PERF, LAUNCHPAD, SCRIBE, PIPELINE
+**Skills Used:** /release-prep, /perf-audit, /store-listing
+
+---
+
+## When to Use
+
+Final checklist before submitting a new app or major version to the Play Store or App Store.
+
+---
+
+## Steps
+
+```
+1. SECURITY — SENTINEL
+   ↓ Full security scan on release build sources.
+   ↓ Block on any CRITICAL or HIGH finding.
+   ↓ MEDIUM findings: document and plan post-launch remediation.
+
+2. PERFORMANCE — PERF + /perf-audit
+   ↓ Measure cold start time (target: < 2 seconds to interactive).
+   ↓ Profile the 3 most-used screens for frame drops.
+   ↓ Memory baseline on a 3-year-old mid-range device.
+
+3. STORE LISTING — LAUNCHPAD + /store-listing
+   ↓ Write or review Play Store / App Store copy.
+   ↓ ASO keyword strategy for launch category.
+   ↓ Screenshot brief for designer.
+
+4. RELEASE NOTES — SCRIBE
+   ↓ Generate first-version release notes from git log.
+   ↓ "What's new in version 1.0" — highlight top 3 features.
+
+5. RELEASE CHECKLIST — /release-prep
+   ↓ Run through the full pre-submission checklist.
+   ↓ All boxes must be checked before submitting.
+
+6. BUILD & DEPLOY — PIPELINE
+   ↓ Generate release build pipeline if not already set up.
+   ↓ Sign and upload to Play Store internal track / TestFlight.
+   ↓ Staged rollout plan: 1% → 5% → 20% → 100%.
+
+7. MONITOR
+   ↓ Watch crash-free rate, ANR rate, rating/review velocity.
+   ↓ Set up alerts for crash rate > 0.5%.
+```
+
+---
+
+## Inputs
+
+- Release branch at feature freeze
+- App store developer account access
+- Designer assets (screenshots, feature graphic, app icon)
+
+---
+
+## Outputs
+
+- Security-cleared, performance-validated release build
+- Complete store listing ready for submission
+- CI/CD pipeline for future releases
+- Monitoring baseline for post-launch tracking