padosoft-mobile-security-reviewlisted

Use this skill before committing or reviewing a change to a React Native / Expo app that touches secrets or API keys, token storage, a WebView, a deep link or an external URL, TLS and certificate pinning, a dev/mock/debug surface, or an AI/LLM call — and whenever the user asks whether something can go in the bundle, in an EXPO_PUBLIC_ variable or in MMKV, or asks for a mobile security review or an audit. It runs the checks with their pre-screens and, for a finding whose enforcement lives outside the repository, states the severity conditionally instead of guessing. Do not use it for API-side security (padosoft-api-security-review), store review rejections, or MDM and device fleet policy.
padosoft/skills · ★ 1 · Code & Development · score 80

Install: claude install-skill padosoft/skills

# Mobile security review **The premise that decides everything: the bundle is shipped to every device and can be decompiled.** Anything in the bundle or in a committed asset is public. `EXPO_PUBLIC_*` variables are inlined at build time, so they are public configuration — never a secret, never a runtime security boundary. Run these before committing a change to the areas below. A HIGH/CRITICAL violation should bounce the PR. --- ## 1. No secrets in the bundle — `MOBILE-SEC-SECRET-001` ```bash grep -rnE "privateKey|BEGIN (RSA |EC )?PRIVATE KEY|pkcs12|p12Password|apiKey\s*[:=]\s*[\"']" src apps packages grep -rn "EXPO_PUBLIC_" src apps packages | grep -iE "secret|token|key|password" ``` No private cryptographic material in source: RSA PEM, PKCS12 blobs, the PKCS12 password. No hardcoded API keys. `.env` (non-example) gitignored. **The JS on the device is not obfuscated.** Metro minifies and Hermes emits bytecode: that shortens **names**, not **string constants**. A PEM comes out of a Hermes bundle with `strings`. And an OTA bundle travels over the network and stays in a cache — less friction than native code, not more. **A key distributed over the air is public from the moment you distribute it**, so rotating it does not restore secrecy. ### When the constraint is real, the remediation has to respect it A client certificate has to be **rotatable**, and rotating something in native code needs a store release — whoever does not update is left with a key the server rejec