MASTG Mobile Security Audit

What it does

This skill adds autonomous mobile application security testing capability using the igf (Grapefruit) dynamic instrumentation toolkit. It walks through OWASP MASTG v2-aligned checks across storage, cryptography, network, platform, code, resilience, and privacy, collecting command output as evidence and producing a structured markdown report ready for triage. Typical outputs include flagged findings with MASTG test IDs, severity, evidence snippets, and concrete remediation recommendations.

When to use it

Use this skill when you need a systematic security audit of a mobile app (Android or iOS), when onboarding app security reviews, or prior to release to catch high-risk issues like hardcoded secrets, disabled ATS/cleartext traffic, debuggable builds, or weak crypto. It is also useful for follow-up verification after fixes. Requires an igf server and a connected device.

What's included

• Scripts: none bundled in the skill directory (has_scripts=false) — relies on the igf CLI.
• References: skill body includes MASTG test mappings and example igf commands for evidence collection.
• Instructions: step-by-step session setup, runtime monitoring recommendations (http, crypto, privacy pins), and a markdown report template to save results.

Compatible agents

Agents or tooling that can run shell commands and interact with devices (CLI-capable agents such as Code assistants that can invoke igf).