Results for “owasp-mobile-top-10”

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Scans a single file against the OWASP Top 10:2025, tracks cross-file connections, and maintains a persistent findings record.

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.

Conducts penetration testing of iOS and Android mobile applications following the OWASP MASTG to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Systematically assess REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.

Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks, scanning for controls and generating a compliance report.

Addresses HIPAA compliance for mobile health (mHealth) applications, wearable devices, and remote patient monitoring. Covers OCR guidance on mobile device PHI, FDA-regulated mobile medical applications, FTC Health Breach Notification Rule for non-HIPAA apps, BYOD policies, and encryption requirements for ePHI on mobile platforms. Keywords: mHealth, mobile health, HIPAA mobile, wearable, remote monitoring, BYOD, mobile device management, app privacy.

Runs a headless-Chromium sweep at phone/tablet widths to catch off-screen overflow, tiny touch targets, clipped text, and oversized modals, then reports each offender with a screenshot and a concrete fix.

Design mobile-first UIs: touch targets, safe areas, gestures, then enhance up. Use when building for small screens, touch, swipe, PWA, or tablet. Linearized desktop / responsive audit → audit-responsive.

Geocode, POIs, routes, timezones via OpenStreetMap/OSRM.

Audit App Store and Google Play listings for discoverability and conversion — keywords, localized metadata, screenshots, ratings prompts — then emit a prioritized ASO plan. Use when "optimize our store listing", "improve app downloads", or "ASO". Submission mechanics → plan-mobile-readiness. Plan only.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Builds repeatable API security test suites in Postman covering OWASP API Security Top 10 vulnerabilities, with automated authentication, multi-role testing, and CI/CD integration via Newman.

Builds cross-platform mobile apps with Ionic, Angular/React/Vue, and Capacitor. Use for hybrid apps with native-like UI.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

Guides implementing authentication, authorization, input validation, and OWASP Top 10 prevention with secure code patterns and validation checkpoints.

Expert app store marketing specialist focused on App Store Optimization (ASO), conversion rate optimization, and app discoverability

Geocode places, find nearby points of interest, calculate routes and travel times, and look up timezones using free OpenStreetMap, OSRM, and TimeAPI.io data sources.

Geocode, POIs, routes, timezones via OpenStreetMap/OSRM.

Progressive Web App development with Service Workers, offline support, and app-like behavior. Use for caching strategies, install prompts, push notifications, background sync. Activate on "PWA", "Service Worker", "offline", "install prompt", "beforeinstallprompt", "manifest.json", "workbox", "cache-first". NOT for native app development (use React Native), general web performance (use performance docs), or server-side rendering.

Transcribe WhatsApp voice messages using local Whisper CLI. Use when: owner or contact sends an audio/ogg voice message. Combines Whisper transcription + CRM update + task creation. Works offline for short clips, uses OpenAI API for long clips. Hebrew and English supported.

Configure Google Apigee security policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security to defend against OWASP API Top 10 threats.

Routes requests into the correct obsidian-mind mode: install, daily session loop, capture, review, maintenance, multi-agent wiring, or semantic search, using a ready-made Obsidian vault template for persistent agent memory.

Guides authorized Wi-Fi security assessments including handshake capture, PMKID collection, rogue AP detection, and offline password policy evaluation using aircrack-ng, hashcat, and Wireshark.

Composite skill — full security pass across secrets, dependencies, code paths, and OWASP risks. Chains security-audit (broad) + socket-audit (npm supply chain) + semgrep (pattern scan) + code-security (code review for vulns) in parallel, reconciles into one severity-ranked report with remediation plan. Use quarterly per active repo or before any release of security-sensitive code.

Find nearby places (restaurants, cafes, bars, pharmacies, etc.) using OpenStreetMap. Works with coordinates, addresses, cities, zip codes, or Telegram location pins. No API keys needed.

Read-only OWASP LLM Top 10 audit of app-facing AI features: prompt injection, data leak, supply chain, poisoning, unsafe output, excessive agency, system-prompt leak, RAG/embedding risks, misinformation, unbounded consumption. Use when "audit LLM security", "prompt injection", "jailbreak my chatbot", "is my AI safe".

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every techniqu

Unified search API across Google, Amazon, Yelp, OpenTable, Walmart, and more. Use when searching for products, local businesses, restaurants, shopping, images, news, or any web search. One API key, many engines.

Geocode, POIs, routes, timezones via OpenStreetMap/OSRM.

Use Orca's computer-use CLI to inspect and operate local desktop app windows through accessibility trees, screenshots, and safe UI actions. Use for desktop app interaction: list apps/windows, get app state, read visible UI, click controls, type, press keys, scroll, drag, set values, or perform accessibility actions. Also use for browser windows, webviews, Orca app UI, or other desktop UI. Triggers include "computer use", "orca computer", "read Spotify", "read Slack", "control/click/read in a desktop app", and "get app state".

Mobile-first design thinking and decision-making for iOS and Android apps.

Launch and scale mobile apps with ASO, viral loops, monetization, and App Store growth tactics.