reis-mobile 0.4.0 → 0.5.0

package/skills/mobile-ios/references/platform-features.md

@@ -0,0 +1,52 @@
+# iOS platform features
+
+## Permissions
+
+- Every protected API needs its usage description in `Info.plist` (`NSCameraUsageDescription`, `NSLocationWhenInUseUsageDescription`, `NSPhotoLibraryUsageDescription`...) with text that explains the benefit; a missing key crashes the app when the API is used.
+- Ask in context, when the user starts the feature, and handle denied and restricted states with a path to Settings (`UIApplication.openSettingsURLString`).
+- Photo picking with `PhotosPicker` (SwiftUI) or `PHPickerViewController` needs no library permission.
+
+## Push notifications
+
+- Enable the Push Notifications capability; request authorization with `UNUserNotificationCenter.current().requestAuthorization(options:)`; register with `UIApplication.shared.registerForRemoteNotifications()`.
+- Implement `UNUserNotificationCenterDelegate` to show notifications in the foreground and handle taps.
+- Rich media needs a Notification Service Extension; silent pushes need the Background Modes → Remote notifications capability and are throttled by the system.
+- With Firebase Cloud Messaging, follow `mobile-firebase`.
+
+## Universal links and URL schemes
+
+- Universal links: add the Associated Domains capability (`applinks:example.com`) and host `apple-app-site-association` on the domain over HTTPS.
+- Handle incoming URLs with `.onOpenURL` (SwiftUI) or the scene delegate, route through the navigation model, and validate parameters before acting.
+- Custom URL schemes can be claimed by other apps; do not use them for authentication callbacks or privileged actions.
+
+## Background work
+
+- `BGTaskScheduler` with `BGAppRefreshTask` for short refreshes and `BGProcessingTask` for longer maintenance; register identifiers in `Info.plist` (`BGTaskSchedulerPermittedIdentifiers`) and schedule again after each run. The system decides when tasks run.
+- Finishing a short task after the app goes to background: `beginBackgroundTask(withName:)` with the matching `endBackgroundTask`.
+
+## Widgets, Live Activities and App Intents
+
+- Widgets use WidgetKit in an extension target with a `TimelineProvider`; share data with the app through an App Group container, and reload timelines from the app when data changes.
+- Live Activities use ActivityKit and need `NSSupportsLiveActivities` in the app's `Info.plist`.
+- App Intents expose actions to Shortcuts, Siri, Spotlight, widgets and controls; define `AppIntent` types and `AppShortcutsProvider` for discoverable shortcuts.
+
+## In-app purchases with StoreKit 2
+
+```swift
+let products = try await Product.products(for: ["com.example.pro.monthly"])
+let result = try await products[0].purchase()
+if case .success(let verification) = result, case .verified(let transaction) = verification {
+    // unlock content, then:
+    await transaction.finish()
+}
+```
+
+- Start listening to `Transaction.updates` at launch to catch renewals, refunds and purchases made on other devices.
+- Only unlock content for `.verified` transactions; validate entitlements on your server for anything valuable.
+- Test with a StoreKit configuration file in Xcode, then in the sandbox and TestFlight.
+- Check the App Store Review Guidelines on digital goods before choosing a payment method.
+
+## Privacy
+
+- Keep the app's privacy manifest (`PrivacyInfo.xcprivacy`) accurate: data collected, tracking domains and required-reason APIs. Third-party SDKs must ship their own.
+- Request App Tracking Transparency (`ATTrackingManager`) before tracking across apps, with `NSUserTrackingUsageDescription`.

package/skills/mobile-ios/references/ui-navigation.md

@@ -0,0 +1,64 @@
+# iOS UI and navigation
+
+## SwiftUI state
+
+| Wrapper | Use for |
+|---|---|
+| `@State` | Value state owned by the view; also owns an `@Observable` model the view creates |
+| `@Binding` | Two-way access to state owned by a parent |
+| `@Observable` class (iOS 17+) | A model; views update only for properties they read |
+| `@Bindable` | Bindings to properties of an `@Observable` model the view does not own |
+| `ObservableObject` + `@StateObject` / `@ObservedObject` | Models before iOS 17: `@StateObject` where created, `@ObservedObject` where passed in |
+| `@Environment` | Values and models injected from an ancestor |
+| `@FocusState` | Keyboard focus in forms |
+
+A view must not recreate a model it does not own on every update; that resets state.
+
+## Navigation
+
+```swift
+enum Route: Hashable { case order(Order.ID), settings }
+
+struct RootView: View {
+    @State private var path: [Route] = []
+
+    var body: some View {
+        NavigationStack(path: $path) {
+            OrdersList(onSelect: { path.append(.order($0)) })
+                .navigationDestination(for: Route.self) { route in
+                    switch route {
+                    case .order(let id): OrderDetail(id: id)
+                    case .settings: SettingsView()
+                    }
+                }
+        }
+    }
+}
+```
+
+- `NavigationStack` with a path (iOS 16+) makes deep links and state restoration possible; `NavigationView` is deprecated.
+- Pass identifiers in routes, not whole models.
+- Sheets and full-screen covers are driven by optional state (`.sheet(item:)`), not booleans plus separate data.
+
+## Lists and forms
+
+- `List` and `LazyVStack` need stable identity: `Identifiable` models, not indices, for data that changes.
+- Heavy work does not belong in `body`: format, sort and filter in the model.
+- Forms: `Form`, `TextField` with `.textContentType` and `.keyboardType`, `@FocusState` to move between fields and dismiss the keyboard, validation in the model.
+
+## UIKit interop
+
+- Use a UIKit view in SwiftUI with `UIViewRepresentable` / `UIViewControllerRepresentable`, coordinating delegates through a `Coordinator`.
+- Embed SwiftUI in UIKit with `UIHostingController`.
+- In UIKit, prefer diffable data sources and compositional layouts for collections.
+
+## Accessibility and localization
+
+- Support Dynamic Type: system text styles (`.font(.body)`), no fixed heights around text.
+- Label icon-only controls (`.accessibilityLabel`), group related elements, and keep touch targets at least 44×44 points.
+- Test with VoiceOver and the largest accessibility text sizes.
+- Localize user-facing strings with String Catalogs (`.xcstrings`) or `String(localized:)`; SwiftUI `Text("key")` literals are localizable automatically.
+
+## Previews
+
+`#Preview { OrdersList(orders: .fixtures) }` with fixture data and injected fake services, so previews never hit the network.

package/skills/mobile-rn/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: mobile-rn
+description: Builds React Native and Expo apps in TypeScript — navigation with React Navigation or Expo Router, lists, forms, styling, gestures and animations with Reanimated, safe areas, accessibility and localization; networking with TanStack Query, response validation, persistence with MMKV, AsyncStorage, SQLite and secure storage; permissions, push notifications, deep links, background tasks, native modules and config plugins; performance with Hermes and the React profiler; and release with EAS Build, EAS Submit and EAS Update or bare Gradle and Xcode builds. Use when writing or changing React Native code, adding a native capability, configuring Expo, preparing a store build or an over-the-air update, or when the user asks how to do something in React Native, even if they do not name the library.
+intents: [performance, release, accessibility]
+stacks: [react-native]
+---
+
+# Mobile React Native
+
+Guides for building React Native and Expo apps. Cross-platform topics live in their own skills and have React Native references there: architecture and state in `mobile-architecture`, tests in `mobile-test`, debugging (Metro, native modules, builds) in `mobile-debug`, code review in `mobile-code-review`, security in `mobile-security` and Firebase in `mobile-firebase`.
+
+## Pick the topic
+
+| Topic | Read |
+|---|---|
+| Navigation, lists, forms, styling, gestures, animations, accessibility, localization | [references/ui-navigation.md](references/ui-navigation.md) |
+| Networking, server state, validation, persistence, offline | [references/data-networking.md](references/data-networking.md) |
+| Permissions, push, deep links, background work, native modules, config plugins | [references/platform-features.md](references/platform-features.md) |
+| Performance, bundle, EAS Build, store submission and over-the-air updates | [references/performance-release.md](references/performance-release.md) |
+
+## Before writing code
+
+- Detect the setup: Expo (managed with Continuous Native Generation, or with committed `android/` and `ios/`) or bare React Native; the React Native and Expo SDK versions; whether the New Architecture is enabled.
+- Install libraries with `npx expo install` in Expo projects, so versions match the SDK.
+- Libraries with native code need a new native build (a development build in Expo); they do not work in Expo Go unless the Expo SDK includes them.
+- Native requirements of each platform still apply; see `mobile-ios` and `mobile-android` for store and platform specifics.

package/skills/mobile-rn/references/data-networking.md

@@ -0,0 +1,59 @@
+# React Native data and networking
+
+## Server state with TanStack Query
+
+```tsx
+const queryClient = new QueryClient({ defaultOptions: { queries: { staleTime: 30_000, retry: 2 } } });
+
+export function App() {
+  return (
+    <QueryClientProvider client={queryClient}>
+      <RootNavigator />
+    </QueryClientProvider>
+  );
+}
+
+export const useOrder = (orderId: string) =>
+  useQuery({ queryKey: ['orders', orderId], queryFn: () => api.orders.get(orderId) });
+
+export function useCancelOrder() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: api.orders.cancel,
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ['orders'] }),
+  });
+}
+```
+
+The names are illustrative. Use RTK Query instead if the project is built on Redux Toolkit.
+
+- React Native has no window focus or online events: wire `focusManager` to `AppState` and `onlineManager` to NetInfo so queries refetch when the app returns to the foreground or reconnects.
+- Keys include every variable the request depends on.
+
+## HTTP client
+
+- One typed client on `fetch` (or axios, if the project uses it) with a base URL, auth header injection, token refresh and timeouts. `fetch` has no timeout: use an `AbortController` with a timer.
+- `fetch` does not reject on 4xx/5xx; check `response.ok`.
+- Validate or map responses at the boundary (for example with zod) instead of `as` casts in screens.
+- Base URLs and public config come from app config or EAS environment variables; secrets stay on the backend.
+
+## Persistence
+
+| Data | Store |
+|---|---|
+| Tokens, credentials | `expo-secure-store` or `react-native-keychain` (Keychain/Keystore) |
+| Preferences, small key-value data | MMKV (`react-native-mmkv`) or AsyncStorage |
+| Relational or large data | SQLite (`expo-sqlite` or the library the project uses), optionally with an ORM such as Drizzle |
+| Files and media | `expo-file-system` or the file library the project uses |
+| Query cache across launches | TanStack Query persisters, for data that is safe to show stale |
+
+AsyncStorage is unencrypted and asynchronous; do not store secrets there, and avoid large values.
+
+## Offline
+
+- Detect connectivity with `@react-native-community/netinfo` to show offline state, but still handle request failures.
+- For offline-first flows, read from local storage, sync from the network into it, and queue writes with retry and a visible pending state.
+
+## Real-time
+
+WebSockets or server-sent updates must pause or reconnect with `AppState` changes; the OS suspends connections in the background.

package/skills/mobile-rn/references/performance-release.md

@@ -0,0 +1,46 @@
+# React Native performance and release
+
+## Measure before optimizing
+
+- The React profiler in React Native DevTools (or the DevTools version for the project's React Native release) to find components that re-render.
+- The performance monitor for JavaScript and UI frame rates; native profilers (Instruments, Android Studio) for native modules and startup.
+- Test performance in release builds on real devices: development builds are much slower.
+
+## Common fixes
+
+- **Re-renders:** narrow context values, memoize expensive children with stable props, select store slices, keep fast-changing state local.
+- **Lists:** virtualized lists with stable keys and memoized rows (see `ui-navigation.md`).
+- **JavaScript thread:** move animations to Reanimated worklets; defer heavy work until after interactions; avoid large synchronous JSON parsing during navigation.
+- **Startup:** keep Hermes enabled, avoid importing heavy modules at the entry point, show the first screen before loading optional data.
+- **Bundle and size:** remove unused dependencies, check which libraries pull large native SDKs, and remove `console.log` in release builds.
+
+## Versioning
+
+- User-facing version: `version` in the Expo app config, or the native version fields in bare projects (`versionName` on Android, `MARKETING_VERSION` on iOS).
+- Build numbers: iOS `buildNumber` and Android `versionCode` must increase for every store upload. EAS can manage them with `appVersionSource: "remote"` and `autoIncrement` in `eas.json`.
+
+## Building
+
+**Expo / EAS:**
+
+```bash
+eas build --platform ios --profile production
+eas build --platform android --profile production
+eas submit --platform ios --latest
+```
+
+- Build profiles live in `eas.json` (development, preview, production); credentials are managed by EAS or provided by the team.
+- Environment variables per environment are configured in EAS; values available to the app code are public.
+
+**Bare React Native:** `./gradlew bundleRelease` in `android/` for an AAB, and an Xcode archive for iOS; store requirements and signing follow `mobile-android` and `mobile-ios`.
+
+## Over-the-air updates
+
+- EAS Update (or the update service the project uses) ships JavaScript and asset changes only. Anything that changes native code, native config or config plugins needs a new store build.
+- `runtimeVersion` must change whenever the native layer changes, so an update never reaches a binary it is incompatible with; prefer a policy such as `fingerprint` or `appVersion` over manual values when possible.
+- Publish to a preview channel first, then roll out to production; keep a way to roll back.
+- Store rules restrict what updates may change (for example, no new features that bypass review on iOS); check the current guidelines.
+
+## Crash reporting
+
+Upload source maps for release bundles (and dSYMs and R8 mappings for native code) to the crash reporter, so JavaScript and native stack traces are readable.

package/skills/mobile-rn/references/platform-features.md

@@ -0,0 +1,40 @@
+# React Native platform features
+
+## Permissions
+
+- Expo modules expose permission hooks and methods (`useCameraPermissions`, `Location.requestForegroundPermissionsAsync`...); bare projects often use `react-native-permissions`.
+- Declare iOS usage descriptions and Android permissions in native config: in Expo, through the module's config plugin options or `ios.infoPlist` and `android.permissions` in the app config; in bare projects, in `Info.plist` and `AndroidManifest.xml`.
+- Ask in context, handle "denied" and "blocked", and link to settings with `Linking.openSettings()`.
+
+## Push notifications
+
+- **Expo:** `expo-notifications` for permissions, tokens, foreground handling (`setNotificationHandler`) and taps; the Expo push service or your own backend with FCM/APNs credentials. Push does not work in Expo Go on every platform and SDK version; use a development build.
+- **Firebase Cloud Messaging:** follow `mobile-firebase` (React Native Firebase).
+- Android 13+ needs the notification permission; iOS needs the Push Notifications capability and an APNs key.
+- Register background handlers at the app entry, outside components.
+
+## Deep links
+
+- Custom scheme: `scheme` in the Expo app config, or intent filters and URL types in bare projects.
+- Universal links and app links: `ios.associatedDomains` and `android.intentFilters` with `autoVerify` in Expo, plus the `apple-app-site-association` and `assetlinks.json` files on your domain.
+- Route links through the navigator's linking configuration and validate parameters before acting.
+
+## Background work
+
+- Periodic background work is limited and scheduled by the OS. In Expo, use the background task module of the SDK in use (`expo-background-task` replaced `expo-background-fetch`; check the SDK docs) with `expo-task-manager`.
+- Uploads and long jobs that must finish belong on the server or in native background transfer APIs, not in JavaScript timers.
+
+## Native modules and config
+
+- **Expo Modules API:** write native modules in Swift and Kotlin with a typed JavaScript interface; works in Expo and bare projects.
+- **Turbo Modules / Fabric components:** the New Architecture native module system in bare projects; define the spec in TypeScript and generate code with Codegen.
+- **Config plugins:** change native projects (Info.plist, manifest, Gradle, Podfile) reproducibly in Expo projects with Continuous Native Generation. Do not hand-edit `android/` and `ios/` in such projects; changes are lost on `npx expo prebuild --clean`.
+- Wrap each native module once in a typed TypeScript API.
+
+## Device capabilities
+
+Camera (`expo-camera` or `react-native-vision-camera`), location (`expo-location`), media library, biometrics (`expo-local-authentication`), haptics and sensors: prefer the libraries the project already uses, check that they support the New Architecture when it is enabled, and add their permissions.
+
+## In-app purchases
+
+Use a maintained library (for example RevenueCat's SDK or `react-native-iap`) or the store APIs through native modules; verify purchases and entitlements on a server, and test with store sandbox accounts. Store rules for digital goods are in `mobile-ios` and `mobile-android`.

package/skills/mobile-rn/references/ui-navigation.md

@@ -0,0 +1,62 @@
+# React Native UI and navigation
+
+## Navigation
+
+Use the router the project has.
+
+**React Navigation** (native stack):
+
+```tsx
+export type RootStackParamList = { Orders: undefined; OrderDetail: { orderId: string } };
+const Stack = createNativeStackNavigator<RootStackParamList>();
+
+export function RootNavigator() {
+  return (
+    <Stack.Navigator>
+      <Stack.Screen name="Orders" component={OrdersScreen} />
+      <Stack.Screen name="OrderDetail" component={OrderDetailScreen} />
+    </Stack.Navigator>
+  );
+}
+```
+
+**Expo Router** (file-based): routes are files under `app/` (`app/orders/[orderId].tsx`), layouts are `_layout.tsx`, navigation uses `<Link href="/orders/42">` or `router.push`, and params come from `useLocalSearchParams`.
+
+- Type route params and pass ids, not objects or functions.
+- Configure deep linking in the router (the `linking` option, or Expo Router's automatic routes) so notifications and links open the right screen.
+- Use native stack navigators for native transitions and gestures.
+
+## Layout and styling
+
+- `StyleSheet.create` or the styling library the project uses; Flexbox with `flexDirection: 'column'` as the default.
+- Safe areas with `react-native-safe-area-context` (`SafeAreaView` or `useSafeAreaInsets`); the core `SafeAreaView` only works on iOS.
+- Dark mode with `useColorScheme` and a theme object, not hardcoded colors.
+- Platform differences in `.ios.tsx`/`.android.tsx` files or `Platform.select`, kept small.
+
+## Lists
+
+- `FlatList`/`SectionList` (or FlashList, if the project uses it) for long or dynamic data, with a stable `keyExtractor`.
+- Memoize `renderItem` components and avoid inline objects on hot rows; provide `getItemLayout` for fixed-height rows.
+- Pull to refresh with `refreshing`/`onRefresh`; pagination with `onEndReached` guarded against duplicate calls.
+
+## Forms and keyboard
+
+- A form library the project has (React Hook Form is common), with schema validation shared with the API layer when possible.
+- `KeyboardAvoidingView` (behavior differs per platform) or a keyboard library the project uses; `keyboardShouldPersistTaps="handled"` on scroll views with inputs.
+- Set `textContentType` (iOS) and `autoComplete` for autofill, and `returnKeyType` with focus chaining between fields.
+
+## Gestures and animations
+
+- Reanimated for animations that run on the UI thread, Gesture Handler for gestures; `Animated` with `useNativeDriver: true` for simple cases.
+- Do not drive per-frame animation through React state.
+
+## Images
+
+`expo-image` (or the image library the project uses) for caching and placeholders; size images close to their display size.
+
+## Accessibility and localization
+
+- `accessibilityRole`, `accessibilityLabel` and `accessibilityState` on touchables; `accessible` groups for composite elements.
+- Respect font scaling; do not set `allowFontScaling={false}` on body text. Touch targets of at least 44–48 points (`hitSlop` for small icons).
+- Test with VoiceOver and TalkBack.
+- Localize with the library the project uses (for example i18next) and the device locale from `expo-localization` or equivalent.

package/skills/mobile-security/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: mobile-security
+description: Security review and hardening for mobile apps on every stack, organized by the OWASP MASVS categories — insecure token and credential storage, hardcoded secrets, cleartext traffic and TLS validation bypass, certificate pinning, exported components and intent handling, deep links, WebView bridges, biometrics, sensitive logging, backups, screenshots and release hardening — with concrete checks for Flutter, native Android, native iOS and React Native. Use when reviewing mobile code for security, auditing an app before release, storing tokens or credentials, handling authentication, deep links or WebViews, or when the user mentions OWASP, MASVS, pentest findings or store security requirements.
+intents: [review, security, release]
+stacks: ["*"]
+---
+
+# Mobile Security
+
+Organized by the OWASP MASVS categories. Apply the general checks below, then the reference for the detected stack. In cross-platform apps, also apply the Android and iOS references to the native folders.
+
+## 1. Pick the reference
+
+| Project | Read |
+|---|---|
+| Flutter | [references/flutter.md](references/flutter.md) |
+| Native Android (Kotlin/Java), or `android/` in any app | [references/android.md](references/android.md) |
+| Native iOS (Swift/Objective-C), or `ios/` in any app | [references/ios.md](references/ios.md) |
+| React Native or Expo | [references/react-native.md](references/react-native.md) |
+
+Firebase-specific protection (security rules, App Check) is covered by `mobile-firebase`.
+
+## 2. Evidence and severity
+
+Every finding needs evidence in the code or configuration at `file:line`. Severity:
+
+- **Critical:** exposed credential or sensitive data, TLS validation disabled, exported component that performs a privileged action, backend authorization missing.
+- **High:** token in insecure storage, cleartext traffic to the API, WebView with a JavaScript bridge exposed to remote content, deep link acting without validation.
+- **Medium/Low:** missing hardening, verbose logs, backup enabled without need, missing screenshot protection.
+
+## 3. General checks (all stacks)
+
+**MASVS-STORAGE**
+- [ ] Access token, refresh token and personal data kept in insecure storage (preferences, plain files, unencrypted database) instead of the Keychain or Keystore-backed storage.
+- [ ] Sensitive data in logs, analytics events or crash reports.
+
+**MASVS-CRYPTO**
+- [ ] Private API keys, client secrets, signing keys or passwords in source code, assets or bundled configuration. Everything shipped in the app can be extracted; a real secret stays on the backend.
+- [ ] Homemade cryptography, fixed IV or key, MD5/SHA-1 for passwords.
+
+**MASVS-AUTH**
+- [ ] Authorization decided only on the client (a local `isAdmin` flag, hiding a button as access control).
+- [ ] Sessions without expiration, or refresh tokens never invalidated on logout.
+- [ ] Biometrics used only as a local boolean, without unlocking a key in the Keychain or Keystore.
+
+**MASVS-NETWORK**
+- [ ] `http://` URLs for APIs.
+- [ ] Certificate validation disabled or overridden to accept everything.
+- [ ] Pinning, if present, without a rotation strategy (a single pin with no backup).
+
+**MASVS-PLATFORM**
+- [ ] Deep links and universal/app links that perform actions without validating parameters or without authentication.
+- [ ] WebViews loading remote content with JavaScript and a native bridge enabled.
+- [ ] Sensitive data on the clipboard or visible in the app switcher snapshot.
+
+**MASVS-CODE / RESILIENCE**
+- [ ] Release builds without obfuscation or minification when the app has sensitive logic.
+- [ ] Debug code, test endpoints or feature flags that bypass checks reachable in release.
+- [ ] Dependencies with known vulnerabilities, or abandoned security-sensitive libraries.
+
+**MASVS-PRIVACY**
+- [ ] Permissions requested without real use in the code.
+- [ ] Third-party SDKs collecting data that is not declared (privacy manifest and App Store privacy details on iOS, Data safety on Google Play).
+
+## 4. Useful commands (read-only)
+
+```bash
+# Signing material and environment files that should not be in the repository
+git ls-files | grep -Ei '\.(jks|keystore|p12|p8|pem|mobileprovision)$|key\.properties|(^|/)\.env(\.|$)'
+
+# Android manifest flags worth reading in context
+grep -rn --include='AndroidManifest.xml' -E 'usesCleartextTraffic|allowBackup|exported="true"|debuggable' . 2>/dev/null
+
+# iOS App Transport Security exceptions
+grep -rn --include='*.plist' 'NSAllowsArbitraryLoads' . 2>/dev/null
+```
+
+`google-services.json` and `GoogleService-Info.plist` identify a Firebase project and ship in every app; committing them is not a leak by itself. The findings there are unrestricted API keys and weak security rules.
+
+## Output
+
+Report under **Security** (or **Critical**, when the severity is Critical), with the MASVS category, `file:line`, impact and fix.

package/skills/{android-intent-security/SKILL.md → mobile-security/references/android/intent-security.md}

@@ -1,31 +1,4 @@
----
-name: android-intent-security
-description: Best practices for Android Intent security. Use this skill when auditing
-  component configurations in AndroidManifest.xml activities, services, receivers)
-  or source code handling incoming Intents (getIntent, getParcelableExtra) to prevent
-  Intent Redirection and unauthorized access.
-license: Apache-2.0
-source: https://github.com/android/skills
-intents: [security, review]
-stacks: [android]
-metadata:
-  author: Google LLC
-  last-updated: '2026-08-14'
-  keywords:
-  - recipe
-  - Android
-  - Security
-  - Intent
-  - Redirection
-  - PendingIntent
-  - ContentProvider
-  - Service
-  - Signature
-  - Verification
-  - sanitizer
-  - Vulnerability
-  - Best Practices
----
+> Adapted from the `android-intent-security` skill in [android/skills](https://github.com/android/skills) (Apache-2.0). See `THIRD_PARTY_NOTICES.md`.
 
 This skill provides guidelines and patterns to secure Android components
 (Activities, Services, Broadcast Receivers, Content Providers) and handle

package/skills/mobile-security/references/android.md

@@ -0,0 +1,37 @@
+# Android security checks
+
+Apply after the general checks in `SKILL.md`, to native Android apps and to the `android/` folder of cross-platform apps. For a deep review of exported components, intents, `PendingIntent`s and intent redirection, follow [android/intent-security.md](android/intent-security.md).
+
+## Manifest and components
+
+- [ ] `activity`, `service`, `receiver` or `provider` with `android:exported="true"` without a permission and without validating the incoming `Intent`.
+- [ ] `android:debuggable="true"` hardcoded in the manifest.
+- [ ] `android:allowBackup="true"` (or absent) in an app with sensitive data, without backup and data extraction rules that exclude it.
+- [ ] `PendingIntent`s created mutable without need, or with implicit base intents.
+- [ ] App links without `android:autoVerify="true"` and a published Digital Asset Links file, so other apps can claim the same URLs.
+
+## Network
+
+- [ ] `android:usesCleartextTraffic="true"`, or a `network_security_config` with `cleartextTrafficPermitted="true"` for production domains.
+- [ ] `network_security_config` trusting user-installed certificates (`<certificates src="user"/>`) outside `debug-overrides`.
+- [ ] A custom `TrustManager` or `HostnameVerifier` that accepts everything.
+
+## Storage and credentials
+
+- [ ] Tokens in `SharedPreferences` or DataStore without encryption. Keep keys in the Android Keystore; Jetpack Security (`EncryptedSharedPreferences`) is deprecated, so check the current recommendation before introducing it.
+- [ ] Keystore passwords in a committed `build.gradle(.kts)` instead of `key.properties` or environment variables.
+- [ ] `BiometricPrompt` used without a `CryptoObject` when it protects credentials.
+
+## UI and logs
+
+- [ ] Screens with sensitive data without `WindowManager.LayoutParams.FLAG_SECURE`, which blocks screenshots and the recents thumbnail.
+- [ ] `Log.d`/`Log.v` with sensitive data not stripped in release (R8 rules or a logging wrapper).
+
+## WebView
+
+- [ ] `setJavaScriptEnabled(true)` with `addJavascriptInterface` on content the app does not control.
+- [ ] `setAllowFileAccess(true)` or universal access from file URLs enabled.
+
+## Release
+
+- [ ] R8 disabled (`isMinifyEnabled = false`) for release when the app has logic worth protecting.

package/skills/{flutter-secure-token-store/SKILL.md → mobile-security/references/flutter/secure-token-store.md}

@@ -1,11 +1,4 @@
----
-name: flutter-secure-token-store
-description: "Stores JWT access tokens on Flutter with platform secure storage (Keychain on iOS, Keystore-backed storage on Android) via flutter_secure_storage. Use when persisting, reading or clearing auth tokens, or when replacing shared_preferences token storage."
-intents: [security]
-stacks: [flutter]
----
-
-# flutter-secure-token-store
+# Storing auth tokens securely in Flutter
 
 ## Description
 Store JWT tokens securely on Flutter using platform secure storage.

package/skills/mobile-security/references/flutter.md

@@ -0,0 +1,30 @@
+# Flutter security checks
+
+Apply after the general checks in `SKILL.md`. The native folders (`android/`, `ios/`) also get [android.md](android.md) and [ios.md](ios.md).
+
+## Storage
+
+- [ ] Tokens in `shared_preferences`, `hive` or `sqflite` without encryption. Use `flutter_secure_storage`, which stores values in the Keychain on iOS and Keystore-backed storage on Android: [flutter/secure-token-store.md](flutter/secure-token-store.md).
+- [ ] Sensitive data cached in plain files under the app documents directory.
+
+## Network
+
+- [ ] `HttpClient.badCertificateCallback` returning `true`, or `HttpOverrides.global` disabling validation: Critical if it reaches the release build.
+- [ ] `dio` or `http` clients built with custom certificate handling that accepts everything outside debug.
+
+## Secrets and logs
+
+- [ ] `print`/`debugPrint`/`log` with a token, `Authorization` header or login payload; `dio`'s `LogInterceptor` enabled in release.
+- [ ] Secrets passed with `--dart-define` or `--dart-define-from-file` and treated as safe: they end up in the binary.
+
+## Release hardening
+
+- [ ] Release builds without `--obfuscate --split-debug-info=<dir>` when the app needs obfuscation. Keep the split debug info to symbolicate crashes.
+- [ ] `kDebugMode`-only checks that also guard security behavior, so the check disappears in release.
+
+## Platform
+
+- [ ] `webview_flutter` with `JavaScriptMode.unrestricted` and `addJavaScriptChannel` loading URLs the app does not control.
+- [ ] Deep links (`go_router`, `app_links`, `uni_links`) that navigate to privileged screens or perform actions without validating parameters and authentication.
+- [ ] Platform channels that expose native capabilities (files, keychain, device identifiers) to any Dart caller without validating arguments.
+- [ ] Biometric login with `local_auth` that only returns a boolean; bind it to a key stored behind biometric protection when it guards credentials.

package/skills/mobile-security/references/ios.md

@@ -0,0 +1,27 @@
+# iOS security checks
+
+Apply after the general checks in `SKILL.md`, to native iOS apps and to the `ios/` folder of cross-platform apps.
+
+## Network
+
+- [ ] `NSAppTransportSecurity` with `NSAllowsArbitraryLoads = true` in `Info.plist` without a justified per-domain exception.
+- [ ] A `URLSessionDelegate` that accepts any `serverTrust` without evaluating it.
+
+## Storage and credentials
+
+- [ ] Tokens in `UserDefaults`, property lists or files instead of the Keychain.
+- [ ] Keychain items with permissive accessibility (`kSecAttrAccessibleAlways*`, deprecated) instead of `...WhenUnlocked` or `...AfterFirstUnlock`; `ThisDeviceOnly` variants for secrets that must not migrate to other devices through backups.
+- [ ] Files with sensitive data written without an appropriate Data Protection class.
+- [ ] Biometrics checked with `LAContext.evaluatePolicy` only as a boolean when they guard credentials; protect the Keychain item with `SecAccessControl` and biometry instead.
+
+## Platform
+
+- [ ] Custom URL schemes performing actions without validation; any app can register the same scheme. Prefer universal links for sensitive flows.
+- [ ] Screens with sensitive data without protection in the app switcher snapshot (cover the content when the scene moves to the background).
+- [ ] Sensitive data copied to `UIPasteboard.general` without an expiration or local-only option.
+- [ ] `WKWebView` loading remote content with `WKScriptMessageHandler`s that perform privileged actions.
+
+## Logs and privacy
+
+- [ ] `NSLog`, `print` or `os_log` with sensitive data; `os_log`/`Logger` values that should be private must not be marked public.
+- [ ] Missing or inaccurate privacy manifest (`PrivacyInfo.xcprivacy`) for the app and third-party SDKs that use required-reason APIs or collect data; check Apple's current requirements.

package/skills/mobile-security/references/react-native.md

@@ -0,0 +1,29 @@
+# React Native security checks
+
+Apply after the general checks in `SKILL.md`. The native folders (`android/`, `ios/`) and native modules also get [android.md](android.md) and [ios.md](ios.md).
+
+## Storage
+
+- [ ] Tokens or credentials in `AsyncStorage` or MMKV without encryption. Use the Keychain/Keystore through `react-native-keychain` or `expo-secure-store`.
+
+## Secrets in the bundle
+
+- [ ] Secrets in `.env` files read through `react-native-config`, `babel` env plugins or `EXPO_PUBLIC_*` variables: they are inlined into the JavaScript bundle and readable in the APK or IPA.
+- [ ] Secrets in `app.json`/`app.config.*` `extra`, which is bundled into the app.
+- [ ] Hermes bytecode treated as protection: it is not obfuscation, and the bundle can be decompiled.
+
+## Network
+
+- [ ] `http://` endpoints allowed through native exceptions added for development and left in release (see the native references).
+- [ ] Certificate pinning libraries configured with a single pin and no rotation plan.
+
+## Platform
+
+- [ ] `react-native-webview` with `originWhitelist={['*']}` and an `onMessage` handler that performs actions, or `injectedJavaScript` exposing tokens to remote content.
+- [ ] Deep links handled through `Linking` or the navigation linking config without validating origin and parameters.
+- [ ] Native modules exposing sensitive capabilities to JavaScript without validating arguments.
+
+## Logs and updates
+
+- [ ] `console.log` with sensitive data not removed in release builds (for example with `babel-plugin-transform-remove-console`).
+- [ ] Over-the-air updates (`expo-updates` or other services) without code signing, so a compromised update channel can ship arbitrary JavaScript. Check whether the update service used supports signing and whether it is enabled.