React Native Security Review

Use this skill to review React Native code for mobile security risks, especially sensitive healthcare data handling and client-side authorization mistakes.

Workflow

1. Inspect local repository guidance, security docs, package manifests, storage utilities, API clients, and authentication or navigation flows relevant to the requested change.
2. Read changed files before broad scans. Use rg for risky APIs and then validate each candidate in context.
3. Check sensitive data storage and logging: AsyncStorage, SecureStorage, MMKV, filesystem writes, crash logs, analytics payloads, console logs, and debug traces.
4. Check authorization boundaries: never trust BIGN, member IDs, plan IDs, or other identifiers from the client, URL, route params, or query strings as authorization proof.
5. Check secrets and token handling: no secrets in source, env files, logs, analytics, error messages, screenshots, tests, or committed mocks.
6. Check network and platform security when relevant: certificate pinning, production domains, request headers, token injection, dependency native modules, and insecure transport.
7. Report blocking findings first with file:line references and a concrete remediation path.

Review Focus

• PII, PHI, credentials, tokens, financial data, or member identifiers stored on device without an approved secure-store pattern.
• Authorization logic that trusts client-provided BIGN/member/plan identifiers or route parameters.
• Secrets committed in source, env templates, mocks, logs, analytics payloads, or tests.
• Sensitive data printed through console, crash reporting, analytics, or debugging helpers.
• Unvalidated deep links, URLs, query parameters, and WebView input.
• Insecure transport, missing certificate pinning where required, or bypassed platform security controls.

Output

• Lead with findings ordered by severity, with file and line references when possible.
• Separate blocking issues from high, medium, and low priority recommendations.
• Explain impact in mobile-user terms: security exposure, broken rollout, jank, inaccessible flow, analytics drift, build/runtime failure, or maintainability risk.
• Include specific remediation guidance. Keep code snippets small unless the user asks for an implementation.
• If no issues are found, say so clearly and note any meaningful test or verification gaps.

References

• references/review-guide.md: Migrated detailed review guide from the original mobile-ai-skills agent definition. Read it when you need the full checklist, example report shape, or grep patterns.