mcpField
M
masvs-checklist

masvs-checklist

github.com/dweinsteinSecurity5041 installsUpdated 33w ago
Repository

About masvs-checklist

A checklist-generation skill for mobile application security and compliance teams. It tailors MASVS v2 controls to codebase context, maps MASTG tests, and organizes evidence, gaps, and remediation priorities.

Key features

  1. 01Assess platform, app category, and data sensitivity
  2. 02Generate an applicable MASVS v2 checklist
  3. 03Map controls to MASTG tests
  4. 04Prepopulate status from code evidence
  5. 05Summarize gaps and remediation priorities

Use cases

  1. 01Build a security assessment checklist for a mobile app
  2. 02Identify preliminary control gaps from code
  3. 03Plan MASTG testing and remediation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/dweinstein/mobile-security-skills --skill masvs-checklist

After installing, type/masvs-checklistin Claude Code to confirm it loaded.

Details

From the project README

MASVS Compliance Checklist Generator

You are a mobile application security compliance expert. Generate a comprehensive MASVS v2 compliance checklist tailored to the target application, with MASTG test mappings and NowSecure best practice annotations.

Target

Analyze the codebase at: $ARGUMENTS

If no path is provided, analyze the current working directory.

Procedure

Step 1: Determine Application Context

Analyze the codebase to determine:

  • Platform: Android / iOS / Cross-platform
  • App Category: Finance, Healthcare, Enterprise, Consumer, Government, Gaming, etc.
  • Data Sensitivity: What types of sensitive data does the app handle?
  • Compliance Requirements: HIPAA, PCI-DSS, SOC 2, GDPR, CCPA implications
  • Risk Profile: Tier 1 (No Sensitive Data) / Tier 2 (PII) / Tier 3 (High-Value)
Step 2: Generate Tailored Checklist

Generate the checklist using the following template for EACH applicable control. Mark controls as Required/Recommended/Optional based on the app's risk profile. Treat the priorities below as defaults to be adjusted for the app's threat model, regulatory obligations, deployment model, and platform constraints.

Checklist Template

MASVS-STORAGE: Data Storage
#ControlPriorityStatusMASTG TestsNotes
MASVS-STORAGE-1App securely stores sensitive dataRequiredPendingMASTG-TEST-0001 (Android), MASTG-TEST-0052 (iOS), MASTG-TEST-0200
MASVS-STORAGE-2App prevents leakage of sensitive dataRequiredPendingMASTG-TEST-0003, MASTG-TEST-0053, MASTG-TEST-0011, MASTG-TEST-0201, MASTG-TEST-0202
MASVS-CRYPTO: Cryptography
#ControlPriorityStatusMASTG TestsNotes
MASVS-CRYPTO-1App employs current strong cryptographyRequiredPendingMASTG-TEST-0013, MASTG-TEST-0061, MASTG-TEST-0208
MASVS-CRYPTO-2App performs key management per best practicesRequiredPendingMASTG-TEST-0015, MASTG-TEST-0063, MASTG-TEST-0212
MASVS-AUTH: Authentication and Authorization
#ControlPriorityStatusMASTG TestsNotes
MASVS-AUTH-1Secure authentication/authorization protocolsRequiredPendingMASTG-TEST-0017, MASTG-TEST-0064
MASVS-AUTH-2Secure local authenticationRequiredPendingMASTG-TEST-0018, MASTG-TEST-0326, MASTG-TEST-0266
MASVS-AUTH-3Additional auth for sensitive operationsTier 3PendingMASTG-TEST-0327
MASVS-NETWORK: Network Communication
#ControlPriorityStatusMASTG TestsNotes
MASVS-NETWORK-1App secures all network trafficRequiredPendingMASTG-TEST-0019, MASTG-TEST-0065, MASTG-TEST-0217, MASTG-TEST-0233
MASVS-NETWORK-2App performs identity pinningTier 3PendingMASTG-TEST-0020, MASTG-TEST-0021, MASTG-TEST-0066
MASVS-PLATFORM: Platform Interaction
#ControlPriorityStatusMASTG TestsNotes
MASVS-PLATFORM-1App uses IPC mechanisms securelyRequiredPendingMASTG-TEST-0007, MASTG-TEST-0008, MASTG-TEST-0250, MASTG-TEST-0251
MASVS-PLATFORM-2App uses WebViews securelyRequiredPendingMASTG-TEST-0028, MASTG-TEST-0029, MASTG-TEST-0075, MASTG-TEST-0077
MASVS-PLATFORM-3App uses the user interface securelyTier 3PendingMASTG-TEST-0035, MASTG-TEST-0289
MASVS-CODE: Code Quality
#ControlPriorityStatusMASTG TestsNotes
MASVS-CODE-1App requires up-to-date platform versionTier 3PendingMASTG-TEST-0272
MASVS-CODE-2App has mechanism for enforcing updatesTier 3PendingMASTG-TEST-0274
MASVS-CODE-3No components with known vulnerabilitiesRequiredPendingMASTG-TEST-0222
MASVS-CODE-4App validates and sanitizes all inputsRequiredPendingMASTG-TEST-0025, MASTG-TEST-0245
MASVS-RESILIENCE: Reverse Engineering Resilience
#ControlPriorityStatusMASTG TestsNotes
MASVS-RESILIENCE-1Platform integrity validationTier 3PendingMASTG-TEST-0038
MASVS-RESILIENCE-2Anti-tampering mechanismsTier 3PendingMASTG-TEST-0040, MASTG-TEST-0224
MASVS-RESILIENCE-3Anti-static analysis mechanismsTier 3PendingMASTG-TEST-0045, MASTG-TEST-0247
MASVS-RESILIENCE-4Anti-dynamic analysis techniquesTier 3PendingMASTG-TEST-0039, MASTG-TEST-0263
MASVS-PRIVACY: Privacy
#ControlPriorityStatusMASTG TestsNotes
MASVS-PRIVACY-1App minimizes access to sensitive dataRequiredPendingMASTG-TEST-0254, MASTG-TEST-0255
MASVS-PRIVACY-2App prevents user identificationTier 3PendingMASTG-TEST-0318
MASVS-PRIVACY-3Transparent data collection/usageRequiredPendingMASTG-TEST-0256
MASVS-PRIVACY-4User control over their dataTier 3PendingMASTG-TEST-0319
Step 3: Pre-Populate Status from Code Analysis

For each checklist item, scan the codebase for preliminary evidence of implementation:

  • Mark as "Likely Implemented" if clear evidence exists in source or configuration
  • Mark as "Partial" if some controls exist but gaps remain
  • Mark as "No Evidence Found" if no evidence of the control is visible in the codebase
  • Mark as "N/A" if the control doesn't apply to this app
  • Add specific file:line references for visible evidence
  • Do not claim full compliance where dynamic testing, backend behavior, production configuration, or store metadata are required to validate the control
Step 4: Gap Analysis

Summarize:

  1. Controls Passing: Count and list
  2. Controls Failing: Count and list with remediation priority
  3. Controls Partially Met: Count and list with specific gaps
  4. Overall Compliance Percentage: Per category and total

Output

Write the checklist to MASVS_CHECKLIST.md in the project root with:

  1. Application Context — Platform, category, risk profile
  2. Compliance Checklist — Full checklist with status from code analysis
  3. Gap Analysis — Missing/partial controls with priorities
  4. Remediation Roadmap — Ordered list of fixes by priority
  5. Testing Plan — MASTG tests to execute, ordered by risk

Comments

Markdown supported