mobile-best-practices 1.5.0 → 1.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/assets/SKILL.md
ADDED
|
@@ -0,0 +1,139 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: mobile-best-practices
|
|
3
|
+
description: "Mobile development intelligence for Android, iOS, Flutter, and React Native. 2,042 searchable entries: 49 architecture patterns, 117 design patterns, 91 UI patterns, 120 anti-patterns, 103 libraries, 228 performance rules, 437 security practices, 73 testing patterns, 56 reasoning rules, 18 project templates, 592 platform-specific guidelines, 80 copy-paste code snippets, and 78 Gradle dependency declarations. Use when building, reviewing, fixing, or optimizing mobile apps."
|
|
4
|
+
license: MIT
|
|
5
|
+
compatibility: Requires Python 3.x for BM25 search. Works with Claude Code and other skills-compatible agents.
|
|
6
|
+
metadata:
|
|
7
|
+
author: tungnk123
|
|
8
|
+
version: "1.6.1"
|
|
9
|
+
usage: "READER | AGENT | CLI"
|
|
10
|
+
invocation: "explicit-only — database is never searched automatically"
|
|
11
|
+
modes:
|
|
12
|
+
reader: "Browse CSV/markdown files directly — no Python or IDE required"
|
|
13
|
+
agent: "Explicit slash command /mobile-best-practices in Claude Code only"
|
|
14
|
+
cli: "python3 scripts/search.py — direct terminal search, works outside Claude Code"
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
# Mobile Best Practices
|
|
18
|
+
|
|
19
|
+
**2,042 searchable best practices** for Android, iOS, Flutter, and React Native. Android-first with Jetpack Compose.
|
|
20
|
+
|
|
21
|
+
## How to Use
|
|
22
|
+
|
|
23
|
+
This skill **does not trigger automatically**. The database is only searched when you explicitly invoke it. Three ways to use it:
|
|
24
|
+
|
|
25
|
+
| Mode | How | Requires |
|
|
26
|
+
|------|-----|----------|
|
|
27
|
+
| **AGENT** | `/mobile-best-practices` slash command in Claude Code | Claude Code + IDE restart |
|
|
28
|
+
| **CLI** | `python3 scripts/search.py "<query>" -p android` | Python 3 |
|
|
29
|
+
| **READER** | Open CSV/markdown files directly | Nothing |
|
|
30
|
+
|
|
31
|
+
### AGENT — Slash command (primary mode)
|
|
32
|
+
|
|
33
|
+
```
|
|
34
|
+
/mobile-best-practices
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
> **Restart your IDE after installing.** The slash command registry is only loaded at startup — the skill will not appear until you restart.
|
|
38
|
+
>
|
|
39
|
+
> ⚠️ **Some IDEs do not support slash skills** (e.g. certain VS Code forks, JetBrains AI Assistant, non-Claude agents). Use CLI mode in those cases.
|
|
40
|
+
|
|
41
|
+
### CLI — Terminal search
|
|
42
|
+
|
|
43
|
+
```bash
|
|
44
|
+
python3 scripts/search.py "<query>" -p android -n 3
|
|
45
|
+
```
|
|
46
|
+
|
|
47
|
+
Works anywhere Python 3 is available. No IDE needed.
|
|
48
|
+
|
|
49
|
+
### READER — Browse files directly
|
|
50
|
+
|
|
51
|
+
No tooling required. Open the source files:
|
|
52
|
+
|
|
53
|
+
| File | Content |
|
|
54
|
+
|------|---------|
|
|
55
|
+
| `data/platforms/android.csv` | 423 Android/Compose guidelines |
|
|
56
|
+
| `data/platforms/ios.csv` | iOS/SwiftUI guidelines |
|
|
57
|
+
| `data/code-snippets.csv` | 80 copy-paste code templates |
|
|
58
|
+
| `data/security.csv` | 437 security practices |
|
|
59
|
+
| `references/CODE-RULES.md` | Code generation rules |
|
|
60
|
+
| `references/CHECKLIST.md` | Pre-delivery checklist |
|
|
61
|
+
|
|
62
|
+
## Installation
|
|
63
|
+
|
|
64
|
+
```bash
|
|
65
|
+
# via npm
|
|
66
|
+
npx mobile-best-practices install
|
|
67
|
+
|
|
68
|
+
# or manually symlink
|
|
69
|
+
ln -s /path/to/mobile-best-practices ~/.claude/skills/mobile-best-practices
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
**After installing, restart your IDE** to register the `/mobile-best-practices` slash command.
|
|
73
|
+
|
|
74
|
+
## Prerequisites
|
|
75
|
+
|
|
76
|
+
Python 3.x required. Check: `python3 --version`
|
|
77
|
+
|
|
78
|
+
## Search
|
|
79
|
+
|
|
80
|
+
```bash
|
|
81
|
+
python3 scripts/search.py "<query>" --domain <domain> [-n <max_results>]
|
|
82
|
+
python3 scripts/search.py "<query>" --platform <platform>
|
|
83
|
+
python3 scripts/search.py "<query>" --domain <domain> --filter-platform <platform>
|
|
84
|
+
python3 scripts/search.py "<query>" --domain <domain> --compact # token-optimized output
|
|
85
|
+
```
|
|
86
|
+
|
|
87
|
+
### Domains (12)
|
|
88
|
+
|
|
89
|
+
| Domain | Use For |
|
|
90
|
+
|--------|---------|
|
|
91
|
+
| `snippet` | Copy-paste code templates |
|
|
92
|
+
| `gradle` | Gradle dependency declarations |
|
|
93
|
+
| `designpattern` | Design patterns & code smell detection |
|
|
94
|
+
| `reasoning` | Product type recommendations |
|
|
95
|
+
| `architecture` | Architecture patterns |
|
|
96
|
+
| `library` | Libraries and dependencies |
|
|
97
|
+
| `ui` | UI patterns and components |
|
|
98
|
+
| `antipattern` | Common mistakes |
|
|
99
|
+
| `performance` | Performance optimization |
|
|
100
|
+
| `security` | Security best practices |
|
|
101
|
+
| `testing` | Testing patterns |
|
|
102
|
+
| `template` | Project starters |
|
|
103
|
+
|
|
104
|
+
### Platforms
|
|
105
|
+
|
|
106
|
+
`android` (423) | `android-xml` (423) | `ios` (60) | `flutter` (54) | `react-native` (55)
|
|
107
|
+
|
|
108
|
+
### Flags
|
|
109
|
+
|
|
110
|
+
`--domain`/`-d` domain | `--platform`/`-p` platform | `--filter-platform`/`-fp` filter | `--stack`/`-s` tech stack | `--max-results`/`-n` count (default: 3) | `--compact`/`-c` shorter output | `--json` JSON output | `--persist` save blueprint
|
|
111
|
+
|
|
112
|
+
## Workflow
|
|
113
|
+
|
|
114
|
+
When user requests mobile work, **default to Android with Jetpack Compose** unless specified otherwise.
|
|
115
|
+
|
|
116
|
+
### Build: search snippet → gradle → platform → antipattern → designpattern → architecture
|
|
117
|
+
|
|
118
|
+
```bash
|
|
119
|
+
python3 scripts/search.py "viewmodel repository" --domain snippet -n 3
|
|
120
|
+
python3 scripts/search.py "hilt room retrofit" --domain gradle -n 5
|
|
121
|
+
python3 scripts/search.py "compose state" --platform android -n 5
|
|
122
|
+
python3 scripts/search.py "android compose" --domain antipattern
|
|
123
|
+
python3 scripts/search.py "repository factory" --domain designpattern
|
|
124
|
+
python3 scripts/search.py "mvvm clean" --domain architecture
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
### Review: antipattern → designpattern → platform → performance → security
|
|
128
|
+
|
|
129
|
+
```bash
|
|
130
|
+
python3 scripts/search.py "android compose viewmodel" --domain antipattern -n 5
|
|
131
|
+
python3 scripts/search.py "code smell switch if-else" --domain designpattern -n 5
|
|
132
|
+
python3 scripts/search.py "state recomposition lifecycle" --platform android -n 5
|
|
133
|
+
python3 scripts/search.py "compose lazy startup" --domain performance
|
|
134
|
+
python3 scripts/search.py "storage encryption api key" --domain security
|
|
135
|
+
```
|
|
136
|
+
|
|
137
|
+
## Code Quality
|
|
138
|
+
|
|
139
|
+
Before generating code, read [code generation rules](references/CODE-RULES.md). Before delivering, verify against [pre-delivery checklist](references/CHECKLIST.md).
|
|
@@ -1,28 +1,91 @@
|
|
|
1
1
|
---
|
|
2
|
-
description: Analyze mobile app for performance issues
|
|
2
|
+
description: Analyze mobile app for performance issues using the mobile-best-practices database
|
|
3
3
|
---
|
|
4
4
|
|
|
5
|
-
Perform a comprehensive performance analysis of
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
5
|
+
Perform a comprehensive performance analysis of this mobile project.
|
|
6
|
+
|
|
7
|
+
**IMPORTANT**: You MUST run every `python3` search command below and base ALL findings exclusively on the database results. Do NOT rely on training data. Every recommendation must come from the database output.
|
|
8
|
+
|
|
9
|
+
## Step 1: Scan the Entire Project
|
|
10
|
+
|
|
11
|
+
Find all relevant source files:
|
|
12
|
+
- Android: `find . -name "*.kt" -o -name "*.kts" -o -name "*.xml" | grep -v build | grep -v .gradle`
|
|
13
|
+
- iOS: `find . -name "*.swift" | grep -v .build`
|
|
14
|
+
- Flutter: `find . -name "*.dart" | grep -v .dart_tool`
|
|
15
|
+
- React Native: `find . -name "*.tsx" -o -name "*.ts" -o -name "*.jsx" -o -name "*.js" | grep -v node_modules`
|
|
16
|
+
|
|
17
|
+
Read the actual source files to understand the current implementation.
|
|
18
|
+
|
|
19
|
+
## Step 2: Search the Database — ALL Entries Required
|
|
20
|
+
|
|
21
|
+
Run ALL of the following searches. Do NOT skip any. Use the results as the authoritative source:
|
|
22
|
+
|
|
23
|
+
```bash
|
|
24
|
+
# Core performance rules — ALL platforms
|
|
25
|
+
python3 ~/.mobile-best-practices/scripts/search.py "startup cold warm launch" --domain performance -n 15
|
|
26
|
+
python3 ~/.mobile-best-practices/scripts/search.py "memory leak allocation heap" --domain performance -n 15
|
|
27
|
+
python3 ~/.mobile-best-practices/scripts/search.py "ui rendering frame drop jank" --domain performance -n 15
|
|
28
|
+
python3 ~/.mobile-best-practices/scripts/search.py "image loading cache bitmap" --domain performance -n 15
|
|
29
|
+
python3 ~/.mobile-best-practices/scripts/search.py "network http caching request" --domain performance -n 15
|
|
30
|
+
python3 ~/.mobile-best-practices/scripts/search.py "battery cpu wakelock background" --domain performance -n 15
|
|
31
|
+
python3 ~/.mobile-best-practices/scripts/search.py "list scroll lazy virtualize" --domain performance -n 15
|
|
32
|
+
python3 ~/.mobile-best-practices/scripts/search.py "database query index room" --domain performance -n 15
|
|
33
|
+
python3 ~/.mobile-best-practices/scripts/search.py "threading coroutine main dispatcher" --domain performance -n 15
|
|
34
|
+
python3 ~/.mobile-best-practices/scripts/search.py "apk size binary proguard shrink" --domain performance -n 10
|
|
35
|
+
|
|
36
|
+
# Android-specific performance
|
|
37
|
+
python3 ~/.mobile-best-practices/scripts/search.py "recomposition compose lambda" --domain performance --filter-platform android -n 15
|
|
38
|
+
python3 ~/.mobile-best-practices/scripts/search.py "derivedStateOf remember stable" --domain performance --filter-platform android -n 15
|
|
39
|
+
python3 ~/.mobile-best-practices/scripts/search.py "baseline profile startup trace" --domain performance --filter-platform android -n 10
|
|
40
|
+
python3 ~/.mobile-best-practices/scripts/search.py "viewmodel stateflow flow" --platform android -n 10
|
|
41
|
+
|
|
42
|
+
# iOS-specific performance
|
|
43
|
+
python3 ~/.mobile-best-practices/scripts/search.py "swiftui view body redraw" --domain performance --filter-platform ios -n 15
|
|
44
|
+
python3 ~/.mobile-best-practices/scripts/search.py "instruments time profiler" --domain performance --filter-platform ios -n 10
|
|
45
|
+
|
|
46
|
+
# Flutter-specific performance
|
|
47
|
+
python3 ~/.mobile-best-practices/scripts/search.py "widget rebuild const build" --domain performance --filter-platform flutter -n 15
|
|
48
|
+
python3 ~/.mobile-best-practices/scripts/search.py "flutter devtools timeline" --domain performance --filter-platform flutter -n 10
|
|
49
|
+
|
|
50
|
+
# React Native-specific performance
|
|
51
|
+
python3 ~/.mobile-best-practices/scripts/search.py "flatlist keyExtractor memo" --domain performance --filter-platform react-native -n 15
|
|
52
|
+
python3 ~/.mobile-best-practices/scripts/search.py "bridge hermes turbo module" --domain performance --filter-platform react-native -n 10
|
|
53
|
+
|
|
54
|
+
# Performance-related anti-patterns
|
|
55
|
+
python3 ~/.mobile-best-practices/scripts/search.py "performance anti-pattern slow blocking" --domain antipattern -n 15
|
|
56
|
+
python3 ~/.mobile-best-practices/scripts/search.py "memory leak context activity" --domain antipattern -n 10
|
|
57
|
+
|
|
58
|
+
# Platform-specific performance guidelines
|
|
59
|
+
python3 ~/.mobile-best-practices/scripts/search.py "performance optimize" --platform android -n 10
|
|
60
|
+
python3 ~/.mobile-best-practices/scripts/search.py "performance optimize" --platform ios -n 10
|
|
61
|
+
python3 ~/.mobile-best-practices/scripts/search.py "performance optimize" --platform flutter -n 10
|
|
62
|
+
python3 ~/.mobile-best-practices/scripts/search.py "performance optimize" --platform react-native -n 10
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
## Step 3: Cross-Reference Project Code Against Database Results
|
|
66
|
+
|
|
67
|
+
For each file scanned in Step 1:
|
|
68
|
+
1. Map patterns found in code to violations identified in the database results
|
|
69
|
+
2. Identify missing optimizations the database recommends
|
|
70
|
+
|
|
71
|
+
## Step 4: Generate Performance Report
|
|
72
|
+
|
|
73
|
+
Structure the report using ONLY findings from database searches above:
|
|
74
|
+
|
|
75
|
+
### Critical Issues (High Severity)
|
|
76
|
+
List each issue with:
|
|
77
|
+
- **File**: exact file path and line number
|
|
78
|
+
- **Issue**: what the database says is wrong
|
|
79
|
+
- **Fix**: exact code change based on database recommendation
|
|
80
|
+
- **Database Rule**: which search result this comes from
|
|
81
|
+
|
|
82
|
+
### Warnings (Medium Severity)
|
|
83
|
+
Same structure as Critical Issues.
|
|
84
|
+
|
|
85
|
+
### Optimization Opportunities (Low Severity)
|
|
86
|
+
Same structure as Critical Issues.
|
|
87
|
+
|
|
88
|
+
### Profiling Tools (from database)
|
|
89
|
+
List only tools mentioned in database search results.
|
|
27
90
|
|
|
28
91
|
Focus on $ARGUMENTS if provided, otherwise analyze the entire project.
|
|
@@ -1,26 +1,111 @@
|
|
|
1
1
|
---
|
|
2
|
-
description: Audit mobile app for security vulnerabilities
|
|
2
|
+
description: Audit mobile app for security vulnerabilities using the mobile-best-practices database
|
|
3
3
|
---
|
|
4
4
|
|
|
5
|
-
Perform a comprehensive security audit of
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
5
|
+
Perform a comprehensive security audit of this mobile project.
|
|
6
|
+
|
|
7
|
+
**IMPORTANT**: You MUST run every `python3` search command below and base ALL findings exclusively on the database results. Do NOT rely on training data. Every vulnerability and recommendation must come from the database output.
|
|
8
|
+
|
|
9
|
+
## Step 1: Scan the Entire Project
|
|
10
|
+
|
|
11
|
+
Find all relevant source files:
|
|
12
|
+
- Android: `find . -name "*.kt" -o -name "*.kts" -o -name "*.xml" -o -name "*.gradle" -o -name "*.json" -o -name "*.properties" | grep -v build | grep -v .gradle`
|
|
13
|
+
- iOS: `find . -name "*.swift" -o -name "*.plist" -o -name "*.entitlements" | grep -v .build`
|
|
14
|
+
- Flutter: `find . -name "*.dart" -o -name "*.yaml" -o -name "AndroidManifest.xml" -o -name "*.plist" | grep -v .dart_tool`
|
|
15
|
+
- React Native: `find . -name "*.tsx" -o -name "*.ts" -o -name "*.js" -o -name "*.json" | grep -v node_modules`
|
|
16
|
+
|
|
17
|
+
Read the actual source files to understand the current security implementation.
|
|
18
|
+
|
|
19
|
+
## Step 2: Search the Database — ALL Entries Required
|
|
20
|
+
|
|
21
|
+
Run ALL of the following searches. Do NOT skip any. Use the results as the authoritative source:
|
|
22
|
+
|
|
23
|
+
```bash
|
|
24
|
+
# Authentication & session security
|
|
25
|
+
python3 ~/.mobile-best-practices/scripts/search.py "authentication token session jwt biometric" --domain security -n 15
|
|
26
|
+
python3 ~/.mobile-best-practices/scripts/search.py "oauth login credential" --domain security -n 15
|
|
27
|
+
python3 ~/.mobile-best-practices/scripts/search.py "session management logout token revoke" --domain security -n 10
|
|
28
|
+
|
|
29
|
+
# Data storage security
|
|
30
|
+
python3 ~/.mobile-best-practices/scripts/search.py "keystore keychain encrypted storage" --domain security -n 15
|
|
31
|
+
python3 ~/.mobile-best-practices/scripts/search.py "sharedpreferences userdefaults plaintext sensitive" --domain security -n 15
|
|
32
|
+
python3 ~/.mobile-best-practices/scripts/search.py "api key secret hardcoded credential" --domain security -n 15
|
|
33
|
+
python3 ~/.mobile-best-practices/scripts/search.py "encryption aes rsa cipher" --domain security -n 15
|
|
34
|
+
|
|
35
|
+
# Network security
|
|
36
|
+
python3 ~/.mobile-best-practices/scripts/search.py "ssl tls certificate pinning network" --domain security -n 15
|
|
37
|
+
python3 ~/.mobile-best-practices/scripts/search.py "https cleartext man-in-the-middle" --domain security -n 15
|
|
38
|
+
python3 ~/.mobile-best-practices/scripts/search.py "network security config trust anchor" --domain security -n 10
|
|
39
|
+
|
|
40
|
+
# Logging & data exposure
|
|
41
|
+
python3 ~/.mobile-best-practices/scripts/search.py "log logcat sensitive data leak" --domain security -n 15
|
|
42
|
+
python3 ~/.mobile-best-practices/scripts/search.py "crash report analytics pii" --domain security -n 10
|
|
43
|
+
python3 ~/.mobile-best-practices/scripts/search.py "clipboard screenshot task switcher" --domain security -n 10
|
|
44
|
+
|
|
45
|
+
# Code & binary security
|
|
46
|
+
python3 ~/.mobile-best-practices/scripts/search.py "root jailbreak detection bypass" --domain security -n 15
|
|
47
|
+
python3 ~/.mobile-best-practices/scripts/search.py "obfuscation proguard r8 minify" --domain security -n 10
|
|
48
|
+
python3 ~/.mobile-best-practices/scripts/search.py "tamper detection integrity" --domain security -n 10
|
|
49
|
+
python3 ~/.mobile-best-practices/scripts/search.py "reverse engineering decompile apk" --domain security -n 10
|
|
50
|
+
|
|
51
|
+
# Input & injection
|
|
52
|
+
python3 ~/.mobile-best-practices/scripts/search.py "input validation injection sql xss" --domain security -n 15
|
|
53
|
+
python3 ~/.mobile-best-practices/scripts/search.py "intent deeplink url scheme" --domain security -n 15
|
|
54
|
+
python3 ~/.mobile-best-practices/scripts/search.py "webview javascript interface" --domain security -n 15
|
|
55
|
+
|
|
56
|
+
# Permissions & privacy
|
|
57
|
+
python3 ~/.mobile-best-practices/scripts/search.py "permission runtime privacy gdpr" --domain security -n 15
|
|
58
|
+
python3 ~/.mobile-best-practices/scripts/search.py "location camera microphone background" --domain security -n 10
|
|
59
|
+
|
|
60
|
+
# Platform-specific security
|
|
61
|
+
python3 ~/.mobile-best-practices/scripts/search.py "android manifest exported broadcast" --domain security --filter-platform android -n 15
|
|
62
|
+
python3 ~/.mobile-best-practices/scripts/search.py "content provider sql injection cursor" --domain security --filter-platform android -n 10
|
|
63
|
+
python3 ~/.mobile-best-practices/scripts/search.py "ios ats app transport security" --domain security --filter-platform ios -n 15
|
|
64
|
+
python3 ~/.mobile-best-practices/scripts/search.py "keychain access group entitlements" --domain security --filter-platform ios -n 10
|
|
65
|
+
python3 ~/.mobile-best-practices/scripts/search.py "flutter dart secure storage plugin" --domain security --filter-platform flutter -n 15
|
|
66
|
+
python3 ~/.mobile-best-practices/scripts/search.py "react native async storage bridge" --domain security --filter-platform react-native -n 15
|
|
67
|
+
|
|
68
|
+
# OWASP Mobile Top 10 coverage
|
|
69
|
+
python3 ~/.mobile-best-practices/scripts/search.py "improper platform usage" --domain security -n 10
|
|
70
|
+
python3 ~/.mobile-best-practices/scripts/search.py "insecure data storage" --domain security -n 10
|
|
71
|
+
python3 ~/.mobile-best-practices/scripts/search.py "insufficient cryptography" --domain security -n 10
|
|
72
|
+
python3 ~/.mobile-best-practices/scripts/search.py "insecure authentication" --domain security -n 10
|
|
73
|
+
python3 ~/.mobile-best-practices/scripts/search.py "binary protection" --domain security -n 10
|
|
74
|
+
|
|
75
|
+
# Platform guidelines for security
|
|
76
|
+
python3 ~/.mobile-best-practices/scripts/search.py "security" --platform android -n 10
|
|
77
|
+
python3 ~/.mobile-best-practices/scripts/search.py "security" --platform ios -n 10
|
|
78
|
+
python3 ~/.mobile-best-practices/scripts/search.py "security" --platform flutter -n 10
|
|
79
|
+
python3 ~/.mobile-best-practices/scripts/search.py "security" --platform react-native -n 10
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
## Step 3: Cross-Reference Project Code Against Database Results
|
|
83
|
+
|
|
84
|
+
For each file scanned in Step 1:
|
|
85
|
+
1. Search for hardcoded secrets, API keys, and credentials
|
|
86
|
+
2. Map insecure patterns found in code to vulnerabilities identified in the database
|
|
87
|
+
3. Check Manifest/Info.plist/pubspec/package.json for misconfigurations
|
|
88
|
+
|
|
89
|
+
## Step 4: Generate Security Audit Report
|
|
90
|
+
|
|
91
|
+
Structure the report using ONLY findings from database searches above:
|
|
92
|
+
|
|
93
|
+
### High Severity Vulnerabilities
|
|
94
|
+
List each vulnerability with:
|
|
95
|
+
- **File**: exact file path and line number
|
|
96
|
+
- **Vulnerability**: what the database identifies as the issue
|
|
97
|
+
- **Risk**: impact described by the database
|
|
98
|
+
- **Remediation**: exact fix based on database recommendation
|
|
99
|
+
- **OWASP Category**: if applicable
|
|
100
|
+
- **Database Rule**: which search result this comes from
|
|
101
|
+
|
|
102
|
+
### Medium Severity Vulnerabilities
|
|
103
|
+
Same structure as High Severity.
|
|
104
|
+
|
|
105
|
+
### Low Severity / Best Practice Gaps
|
|
106
|
+
Same structure as High Severity.
|
|
107
|
+
|
|
108
|
+
### Security Checklist (from database)
|
|
109
|
+
Checklist items drawn directly from database search results, checked against the project.
|
|
25
110
|
|
|
26
111
|
Focus on $ARGUMENTS if provided, otherwise audit the entire project.
|
|
@@ -1,41 +1,106 @@
|
|
|
1
1
|
---
|
|
2
|
-
description: Set up a new Android project with best practices
|
|
2
|
+
description: Set up a new Android project with best practices using the mobile-best-practices database
|
|
3
3
|
---
|
|
4
4
|
|
|
5
|
-
Set up a new Android project following mobile development best practices
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
5
|
+
Set up a new Android project following mobile development best practices.
|
|
6
|
+
|
|
7
|
+
**IMPORTANT**: You MUST run every `python3` search command below and base ALL decisions exclusively on the database results. Do NOT rely on training data. Every architectural choice, dependency, and code template must come from the database output.
|
|
8
|
+
|
|
9
|
+
## Step 1: Determine App Type
|
|
10
|
+
|
|
11
|
+
App type from arguments: $ARGUMENTS
|
|
12
|
+
|
|
13
|
+
If not specified, ask the user for: app type (e-commerce, banking, social media, healthcare, delivery, fitness, education, chat), target Android min SDK, and any required features.
|
|
14
|
+
|
|
15
|
+
## Step 2: Search the Database — ALL Entries Required
|
|
16
|
+
|
|
17
|
+
Run ALL of the following searches. Do NOT skip any:
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
# Reasoning: get product-type specific recommendations
|
|
21
|
+
python3 ~/.mobile-best-practices/scripts/search.py "$ARGUMENTS" --domain reasoning -n 5
|
|
22
|
+
python3 ~/.mobile-best-practices/scripts/search.py "android app type recommendation" --domain reasoning -n 5
|
|
23
|
+
|
|
24
|
+
# Architecture patterns
|
|
25
|
+
python3 ~/.mobile-best-practices/scripts/search.py "mvvm clean architecture repository" --domain architecture -n 10
|
|
26
|
+
python3 ~/.mobile-best-practices/scripts/search.py "mvi android unidirectional" --domain architecture -n 5
|
|
27
|
+
python3 ~/.mobile-best-practices/scripts/search.py "modularization multi-module feature" --domain architecture -n 5
|
|
28
|
+
|
|
29
|
+
# Code snippets — get ALL templates
|
|
30
|
+
python3 ~/.mobile-best-practices/scripts/search.py "viewmodel hilt stateflow" --domain snippet -n 10
|
|
31
|
+
python3 ~/.mobile-best-practices/scripts/search.py "repository datasource usecase" --domain snippet -n 10
|
|
32
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose screen navigation route" --domain snippet -n 10
|
|
33
|
+
python3 ~/.mobile-best-practices/scripts/search.py "room database dao entity" --domain snippet -n 10
|
|
34
|
+
python3 ~/.mobile-best-practices/scripts/search.py "retrofit okhttp service" --domain snippet -n 10
|
|
35
|
+
python3 ~/.mobile-best-practices/scripts/search.py "hilt module provides inject" --domain snippet -n 10
|
|
36
|
+
python3 ~/.mobile-best-practices/scripts/search.py "datastore preferences flow" --domain snippet -n 5
|
|
37
|
+
python3 ~/.mobile-best-practices/scripts/search.py "paging compose lazycolumn" --domain snippet -n 5
|
|
38
|
+
python3 ~/.mobile-best-practices/scripts/search.py "workmanager background sync" --domain snippet -n 5
|
|
39
|
+
python3 ~/.mobile-best-practices/scripts/search.py "theme material3 color scheme" --domain snippet -n 5
|
|
40
|
+
|
|
41
|
+
# Gradle dependencies — get ALL declarations
|
|
42
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose bom material3" --domain gradle -n 10
|
|
43
|
+
python3 ~/.mobile-best-practices/scripts/search.py "hilt dagger ksp" --domain gradle -n 10
|
|
44
|
+
python3 ~/.mobile-best-practices/scripts/search.py "room ksp database" --domain gradle -n 10
|
|
45
|
+
python3 ~/.mobile-best-practices/scripts/search.py "retrofit okhttp serialization" --domain gradle -n 10
|
|
46
|
+
python3 ~/.mobile-best-practices/scripts/search.py "coil image loading" --domain gradle -n 5
|
|
47
|
+
python3 ~/.mobile-best-practices/scripts/search.py "navigation compose" --domain gradle -n 5
|
|
48
|
+
python3 ~/.mobile-best-practices/scripts/search.py "paging3 compose" --domain gradle -n 5
|
|
49
|
+
python3 ~/.mobile-best-practices/scripts/search.py "junit mockk turbine testing" --domain gradle -n 10
|
|
50
|
+
python3 ~/.mobile-best-practices/scripts/search.py "datastore preferences" --domain gradle -n 5
|
|
51
|
+
python3 ~/.mobile-best-practices/scripts/search.py "workmanager" --domain gradle -n 5
|
|
52
|
+
|
|
53
|
+
# Android platform best practices
|
|
54
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose state lifecycle" --platform android -n 10
|
|
55
|
+
python3 ~/.mobile-best-practices/scripts/search.py "navigation type-safe serializable" --platform android -n 10
|
|
56
|
+
python3 ~/.mobile-best-practices/scripts/search.py "dependency injection hilt" --platform android -n 10
|
|
57
|
+
python3 ~/.mobile-best-practices/scripts/search.py "coroutine flow scope dispatcher" --platform android -n 10
|
|
58
|
+
python3 ~/.mobile-best-practices/scripts/search.py "version catalog toml" --platform android -n 5
|
|
59
|
+
|
|
60
|
+
# Anti-patterns to avoid from day one
|
|
61
|
+
python3 ~/.mobile-best-practices/scripts/search.py "android architecture anti-pattern" --domain antipattern --filter-platform android -n 15
|
|
62
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose recomposition god class" --domain antipattern --filter-platform android -n 10
|
|
63
|
+
python3 ~/.mobile-best-practices/scripts/search.py "memory leak context coroutine" --domain antipattern --filter-platform android -n 10
|
|
64
|
+
|
|
65
|
+
# Performance foundations
|
|
66
|
+
python3 ~/.mobile-best-practices/scripts/search.py "startup baseline profile" --domain performance --filter-platform android -n 10
|
|
67
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose lazy image cache" --domain performance --filter-platform android -n 10
|
|
68
|
+
|
|
69
|
+
# Security foundations
|
|
70
|
+
python3 ~/.mobile-best-practices/scripts/search.py "android keystore encrypted api key" --domain security --filter-platform android -n 10
|
|
71
|
+
python3 ~/.mobile-best-practices/scripts/search.py "network certificate pinning https" --domain security --filter-platform android -n 10
|
|
72
|
+
|
|
73
|
+
# Testing setup
|
|
74
|
+
python3 ~/.mobile-best-practices/scripts/search.py "unit test viewmodel coroutine turbine" --domain testing --filter-platform android -n 10
|
|
75
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose ui test espresso" --domain testing --filter-platform android -n 10
|
|
76
|
+
|
|
77
|
+
# UI patterns
|
|
78
|
+
python3 ~/.mobile-best-practices/scripts/search.py "compose scaffold navigation bottom" --domain ui --filter-platform android -n 10
|
|
79
|
+
python3 ~/.mobile-best-practices/scripts/search.py "material3 component theme" --domain ui --filter-platform android -n 10
|
|
80
|
+
|
|
81
|
+
# Project template
|
|
82
|
+
python3 ~/.mobile-best-practices/scripts/search.py "$ARGUMENTS android" --domain template -n 3
|
|
83
|
+
python3 ~/.mobile-best-practices/scripts/search.py "android compose mvvm" --domain template -n 3
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
## Step 3: Generate Project Structure
|
|
87
|
+
|
|
88
|
+
Using ONLY the database results above:
|
|
89
|
+
|
|
90
|
+
1. **Folder Structure** — based on architecture search results
|
|
91
|
+
2. **libs.versions.toml** — ALL dependencies from `gradle` domain results
|
|
92
|
+
3. **build.gradle.kts (app)** — using version catalog references from database
|
|
93
|
+
4. **Hilt Application class** — from snippet results
|
|
94
|
+
5. **DI modules** — from snippet results
|
|
95
|
+
6. **Base ViewModel** — from snippet results
|
|
96
|
+
7. **Repository template** — from snippet results
|
|
97
|
+
8. **Navigation graph** — from snippet results
|
|
98
|
+
9. **Theme setup** — from snippet results
|
|
99
|
+
10. **Network module** — from snippet results
|
|
100
|
+
11. **Database setup** — from snippet results
|
|
101
|
+
|
|
102
|
+
## Step 4: Apply Anti-Patterns Checklist
|
|
103
|
+
|
|
104
|
+
Before delivering, verify the project avoids ALL anti-patterns from the database results in Step 2.
|
|
105
|
+
|
|
106
|
+
Provide a complete, production-ready project structure with every file fully implemented.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "mobile-best-practices",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.1",
|
|
4
4
|
"description": "CLI to install Mobile Best Practices skill for AI coding assistants",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -16,15 +16,15 @@
|
|
|
16
16
|
"prepublishOnly": "npm run build"
|
|
17
17
|
},
|
|
18
18
|
"dependencies": {
|
|
19
|
-
"commander": "^12.1.0",
|
|
20
19
|
"chalk": "^5.3.0",
|
|
20
|
+
"commander": "^12.1.0",
|
|
21
21
|
"ora": "^8.1.1",
|
|
22
22
|
"prompts": "^2.4.2"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@types/node": "^22.0.0",
|
|
26
26
|
"@types/prompts": "^2.4.9",
|
|
27
|
-
"typescript": "^5.
|
|
27
|
+
"typescript": "^5.9.3"
|
|
28
28
|
},
|
|
29
29
|
"keywords": [
|
|
30
30
|
"mobile",
|
|
@@ -54,4 +54,4 @@
|
|
|
54
54
|
"bugs": {
|
|
55
55
|
"url": "https://github.com/tungnk123/mobile-best-practices/issues"
|
|
56
56
|
}
|
|
57
|
-
}
|
|
57
|
+
}
|
|
Binary file
|