agentsclimarketplace
Sign in

React native security

Skill ComeOnOliver/skillshub/skills/HoangNguyen0403/agent-skills-standard/react-native-security

Secure storage, deep linking security, and certificate pinning for mobile. Use when implementing secure storage, certificate pinning, or deep link validation in React Native. (triggers: **/*.tsx, **/*.ts, security, keychain, secure-storage, deep-link, certificate-pinning)From its SKILL.md

Install
npx -y skills add ComeOnOliver/skillshub --skill react-native-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

2.0 KB, 403 tokens by cl100k_base, as published. Nobody here has run it

React Native Security

Priority: P0 (CRITICAL)

Secure Storage

  • Keychain/Keystore: Use react-native-keychain for tokens, passwords.
  • Never AsyncStorage: Not encrypted. Only for non-sensitive data.
  • Biometric Auth: Use react-native-biometrics for Face ID/Touch ID.

Deep Linking

  • Validate URLs: Check scheme and host before navigation.
  • Sanitize Params: Never trust URL params. Validate and sanitize.
  • Token Extraction: Avoid passing tokens in deep link URLs. Use secure code exchange.

Network Security

  • HTTPS Only: Enforce via NSAppTransportSecurity (iOS) and network_security_config.xml (Android).
  • Certificate Pinning: Use react-native-ssl-pinning for high-security apps (banking, healthcare). Warning: Requires app update when certificates rotate.
  • No Secrets in Code: Use .env files with react-native-config. Add to .gitignore.

Code Obfuscation

  • Hermes: Bytecode harder to reverse-engineer.
  • ProGuard/R8: Enable on Android.
  • Note: Obfuscation is a deterrent, not protection. Move sensitive logic to backend.

Data Handling

  • PII Masking: Mask email/phone in logs and analytics.
  • Clipboard: Clear sensitive data after paste.
  • Screenshots: Block on sensitive screens with react-native-screen-guard.

Anti-Patterns

  • No Hardcoded Secrets: Use environment variables.
  • No Sensitive Logs: Strip console.log in production.
  • No Plain HTTP: Always use HTTPS.
  • No Client-Side Auth: Validate on backend.

References

See references/keychain-usage.md for Keychain, Biometrics, SSL Pinning, and PII Masking.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.