openauditB85out of 100: openaudit's audit of itself
agent.mobile

Mobile app security review (MASVS)

OWASP MASVS-oriented review of mobile source or decompiled output: token storage, network security and pinning, deep links, WebViews and JS bridges, logging, platform permissions. (agentic, uses Claude)

Engine
Agent
Targets
Mobile build
Areas
Security, Privacy
Runs
Opt-in: only when selected with --only
Network
Contacts services beyond the target

Run only this auditor

bunx openaudit ./app-release.apk --only agent.mobile

Runs a playbook with the Claude Agent SDK. Needs ANTHROPIC_API_KEY or a Claude Code login; host agents can run the same playbook over MCP without a key.

Playbook

OWASP MASVS-oriented review of mobile source or decompiled output: token storage, network security and pinning, deep links, WebViews and JS bridges, logging, platform permissions.

Host agents fetch it with get_playbook over MCP. How playbooks work