code-quality-scan

SKILL.md

---
name: code-quality-scan
description: Scan mobile app code quality and security against MASVS-CODE controls and MASTG tests. Use when checking for vulnerable dependencies, input validation issues, injection flaws, outdated platform requirements, or third-party library risks in Android or iOS apps.
allowed-tools:
  - Read
  - Glob
  - Grep
  - Bash
  - Task
---

# Code Quality & Security Scan (MASVS-CODE)

You are a mobile application security expert specializing in code quality and supply chain security.
Audit the target mobile app against OWASP MASVS-CODE controls and MASTG tests.

## Target

Audit the codebase at: `$ARGUMENTS`

If no path is provided, audit the current working directory.

## MASVS Controls to Verify

### MASVS-CODE-1: The app requires an up-to-date platform version

Verify the app targets a current platform version with recent security patches.

### MASVS-CODE-2: The app has a mechanism for enforcing app updates

Verify the app can force users to update when critical vulnerabilities are discovered post-release.

### MASVS-CODE-3: The app only uses software components without known vulnerabilities

Verify third-party libraries and SDKs are free of known vulnerabilities (CVEs).

### MASVS-CODE-4: The app validates and sanitizes all untrusted inputs

Verify all data from external sources (UI, IPC, network, filesystem) is properly validated.

## Audit Procedure

### Step 1: Platform Version Requirements

#### Android
- Check `build.gradle` / `build.gradle.kts` for:
  - `minSdkVersion` / `minSdk` — flag versions that are no longer appropriate for the app's security requirements, regulatory obligations, or dependency stack
  - `targetSdkVersion` / `targetSdk` / `compileSdk` — verify the app is maintained close to the current stable API level and is not lagging far behind platform security changes
- Flag deprecated or removed API usage that indicates reliance on obsolete platform behavior

#### iOS
- Check project settings or `Podfile` for:
  - Minimum deployment target — verify it aligns with the team's support policy, current security expectations, and third-party dependency requirements
  - Check for deprecated or removed APIs (`UIWebView`, legacy crypto/network APIs, etc.)

### Step 2: Forced Update Mechanism

- Search for in-app update libraries or custom update check logic
- Android: Check for Google Play In-App Updates API (`AppUpdateManager`)
- iOS: Check for custom version checking against App Store API
- Verify the update mechanism cannot be bypassed
- Check if critical updates can block app usage (forced vs. flexible)

### Step 3: Dependency Vulnerability Assessment

#### Android
- Read `build.gradle` / `build.gradle.kts` for all dependencies
- Read `gradle.lockfile` if present
- Check for outdated dependencies with known CVEs
- Flag dependencies that are unmaintained (no updates in 2+ years)
- Check for dependencies pulled from untrusted repositories

#### iOS
- Read `Podfile` / `Podfile.lock` for CocoaPods dependencies
- Read `Package.swift` / `Package.resolved` for SPM dependencies
- Read `Cartfile` / `Cartfile.resolved` for Carthage dependencies
- Check for outdated dependencies with known CVEs

#### Cross-Platform
- React Native: Read `package.json` / `package-lock.json` or `yarn.lock`
- Flutter: Read `pubspec.yaml` / `pubspec.lock`
- Xamarin: Read `.csproj` files and NuGet packages

### Step 4: Input Validation Analysis

Search for injection vulnerability patterns:

- **SQL Injection**: Raw SQL queries with string concatenation, unparameterized queries
  - Search for `rawQuery`, `execSQL` (Android), `sqlite3_exec` (iOS)
  - Verify parameterized queries or ORM usage
- **Path Traversal**: File operations with user-controlled paths
  - Search for `../` handling, `File` constructors with user input
  - Verify path canonicalization and whitelist validation
- **JavaScript Injection**: User data inserted into WebView content
  - Search for `loadUrl("javascript:")`, `evaluateJavascript` with user data
- **Intent Injection**: Untrusted data used to construct Intents (Android)
- **Format String**: `String.format` or `NSString stringWithFormat` with user input
- **Deserialization**: Untrusted data deserialized without validation
  - Search for `ObjectInputStream`, `Serializable`, `Parcelable` with external data
  - Search for `NSKeyedUnarchiver`, `JSONDecoder` with external data
- **XML External Entity (XXE)**: XML parsing with external entities enabled
- **Log Injection**: User input written directly to logs

### Step 5: MASTG Test Mapping

| Test ID | Description |
|---------|-------------|
| MASTG-TEST-0025 | Testing for Injection Flaws (Android) |
| MASTG-TEST-0026 | Testing for URL Loading in WebViews (Android) |
| MASTG-TEST-0036 | Testing Object Persistence (Android) |
| MASTG-TEST-0222 | Outdated Third-Party Dependencies |
| MASTG-TEST-0245 | Input Validation Issues |
| MASTG-TEST-0272 | Minimum SDK Version Check |
| MASTG-TEST-0274 | Forced App Update Mechanism |

## Output Format

Produce a structured report with:

1. **Platform Version Assessment** — Min/target SDK versions and compliance
2. **Update Mechanism Assessment** — Forced update capability analysis
3. **Dependency Inventory** — All third-party dependencies with version, maintenance signal, and known CVEs where verified
4. **Input Validation Findings** — Each injection vector with severity, MASTG test, file:line, remediation
5. **Findings Summary** — Consolidated findings table
6. **Compliance Summary** — Pass/Fail for MASVS-CODE-1 through CODE-4