Name: mobile-code-review
Rating: 67.2 (1 reviews)
Author: OWASP

mobile-code-review

Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0. Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module.

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A lean, well-sequenced review procedure with concrete file-level guidance and clear conditionals. The main weakness is progressive disclosure: the body points to numerous external files (plays/, data/masvs/, data/mastg/, templates/) that are not shipped in the bundle, so the promised navigation breaks.

Suggestions

Ship the referenced files (plays/mobile-code-review.md, the data/masvs/ and data/mastg/ datasets, templates/finding.md) inside the skill bundle, or move them under references/ so the body's navigation resolves to real files.

Include one concrete inline example of a finding (e.g. a sample templates/finding.md entry) so the output format is unambiguous without relying on an external template.

Add an explicit validation/verification checkpoint in the workflow — e.g. 'confirm every MASTG test ID cited in a finding exists in data/mastg/ before finalizing' — to give the procedure a feedback loop.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational with no padding or explanation of concepts Claude already knows (no 'what is MASVS' preamble); every line carries procedure, file paths, or output spec, matching the 'lean and efficient; every token earns its place' anchor.	5 / 5
Actionability	Gives concrete, executable guidance — specific fingerprint targets (AndroidManifest.xml, build.gradle, Info.plist, *.xcodeproj), exact file paths to load (data/masvs/MASVS-<GROUP>-<N>.md), and a finding template; falls short of 5 because no example finding is shown inline and the MASTG cross-ref grouping rule is specified only abstractly.	4 / 5
Workflow Clarity	A clear 5-step sequence (Scope → Platform Detection → Systematic Review → Diff Analysis → Produce Findings) with explicit conditional checkpoints ('declare partial coverage', 'verify pinning, permissions ... are not weakened', dedup rule); not 5 because there is no explicit validate→fix→retry feedback loop, though this read-only review skill is not destructive.	4 / 5
Progressive Disclosure	The body is well-structured as an overview and signals one-level-deep references with backticks (plays/mobile-code-review.md, data/masvs/, data/mastg/, templates/finding.md), but none of these referenced files are present in the skill's bundle (no references/scripts/assets dirs, and plays/data/templates do not exist), so the navigation it promises does not resolve.	3 / 5
	Total	16 / 20 Passed

Description

82%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly answers both what the skill does and when to trigger it, with a distinct mobile-security niche. Its only weakness is capability breadth — it names a single review action rather than enumerating several concrete operations.

Dimension	Reasoning	Score
Specificity	Names the domain ('native Android and iOS mobile app source code') and one concrete action ('review ... against OWASP MASVS v2.1.0'), but lists only a single capability rather than several specific actions, matching the '1-2 concrete actions, not comprehensive' anchor; not a 4 because it does not enumerate multiple distinct actions.	3 / 5
Completeness	Explicitly states both what it does ('Security-focused review of native Android and iOS mobile app source code against OWASP MASVS v2.1.0') and when to use it ('Use when reviewing mobile codebases, mobile PR diffs, or auditing a mobile module') with concrete trigger phrases, matching the top anchor.	5 / 5
Trigger Term Quality	Includes natural user-facing terms ('mobile codebases', 'mobile PR diffs', 'auditing a mobile module', Android, iOS) with good coverage; falls short of 5 because common synonyms like Kotlin/Swift or '.apk/.ipa' extensions are absent.	4 / 5
Distinctiveness Conflict Risk	The MASVS-specific mobile-native niche ('native Android and iOS', 'OWASP MASVS v2.1.0', 'mobile PR diffs') gives it a clear, distinct trigger surface with minimal overlap risk against general code-review skills.	5 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: OWASP/secure-agent-playbook
Path: plugins/code-security-skills/skills/mobile-code-review/SKILL.md
Commit: 79fea6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.