# Mobile Security

> Skill — Mobile Security Architecture

- Skill: `sairam0424/mobile-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sairam0424/mobile-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sairam0424/mobile-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sairam0424 (https://skillmd.com/u/sairam0424)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sairam0424/mobile-security

---


# Skill — Mobile Security Architecture

## When this skill activates
This skill activates when implementing security-sensitive mobile features, including certificate pinning, secure storage, biometric authentication, root/jailbreak detection, or protecting against mobile-specific attack vectors.

## Mandatory actions when this skill is active

### Before writing any code
1. Review OWASP Mobile Top 10 and identify applicable threats to the application
2. Determine data classification and storage requirements (keychain/keystore for sensitive data, never UserDefaults/SharedPreferences)
3. Establish certificate pinning strategy (pin leaf certificate, intermediate, or public key hash)
4. Plan authentication flow with biometric fallback, token refresh, and secure token storage

### During implementation
- Store sensitive data in platform secure storage (iOS Keychain with proper accessibility attributes, Android Keystore)
- Implement certificate pinning for API communications to prevent man-in-the-middle attacks
- Use biometric authentication (Face ID, Touch ID, Biometric Prompt) with proper fallback to passcode
- Implement root/jailbreak detection (check for common indicators, but never rely solely on client-side checks)
- Encrypt local databases and sensitive files using platform encryption APIs (SQLCipher, native encryption)
- Obfuscate code (ProGuard/R8 for Android, native code for critical logic) to deter reverse engineering
- Implement proper session management with token expiration, refresh tokens, and secure logout

### After implementation
- Test security implementation with security scanning tools (MobSF, QARK, or commercial tools)
- Verify certificate pinning works correctly and fails on MITM attempts
- Test biometric authentication edge cases: disabled biometrics, changed biometrics, hardware unavailability
- Validate secure storage: data persists securely across app restarts, inaccessible without authentication
- Test root/jailbreak detection on compromised devices, verify graceful degradation or blocking

## Self-check before task completion
- [ ] Sensitive data is never stored in plaintext (logs, UserDefaults, SharedPreferences, temp files)
- [ ] Certificate pinning is implemented for all API endpoints with sensitive data
- [ ] Biometric authentication follows platform best practices (keychain/keystore-backed, proper error handling)
- [ ] Root/jailbreak detection is implemented with appropriate response (warn, degrade functionality, or block)
- [ ] API tokens are stored securely (keychain/keystore) and transmitted securely (HTTPS only, proper headers)
- [ ] App handles security failures gracefully (logout on tampering detection, clear sensitive data on uninstall)