Capacitor Security
Capsec scans your Capacitor or Ionic app for 63+ security issues across secrets, storage, network config, and platform-specific vulnerabilities. Run npx capsec scan with zero setup, and it flags everything from hardcoded API keys to disabled certificate pinning to Android debug mode left on in production. The HTML reports are clean, the CI mode exits dirty on critical finds, and the fixes are concrete (swap Preferences for NativeBiometric, lock down AndroidManifest cleartext settings). It's basically a linter for the OWASP Mobile Top 10, tuned specifically for Capacitor's quirks. If you're shipping a mobile app that touches real user data, run this before your security team does.
- skills.sh installs
- 196
- GitHub stars
- 43
- last updated
- Jun 3, 2026
Install
$ npx -y skills add cap-go/capacitor-skills --skill capacitor-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Capacitor Security
Audit and harden the app layer of a Capacitor app: secrets in the bundle, on-device storage, network transport, WebView and native bridge exposure, and platform manifests.
When to Use
TRIGGER when:
- The user asks for a security audit, OWASP Mobile Top 10 / MASVS review, or wants to fix pentest findings.
- The user wants to run or interpret
@capgo/capgo-sec(capsec) results, rule IDs such asSEC001,STO002,NET003,CAP004,AND004,IOS001. - API keys, service-role keys, or
.envvalues appear insrc/,dist/,www/, orcapacitor.config.*. - Auth tokens are stored with
Preferences.set,localStorage, IndexedDB, or plain SQLite. capacitor.config.*containsserver.cleartext: true,server.url, broadserver.allowNavigation,android.allowMixedContent, orwebContentsDebuggingEnabled: true.- Native files contain
NSAllowsArbitraryLoads,android:usesCleartextTraffic="true",android:allowBackup="true",android:debuggable, or exported components without permissions. - The user needs certificate pinning, a Content Security Policy, screenshot protection, or root/jailbreak detection.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/cap-go/capacitor-skills
- Categories
- Security, Mobile Development
- First seen
- Jun 3, 2026
More from cap-go/capacitor-skills
All 13Recommended
More Security
firestore-security-rules-auditorfirebase/skillsfirestore security rules auditor123skills.sh installs
Security Monitoringclaude-office-skills/skillsAutomate security monitoring, threat detection, incident response, and compliance workflows0skills.sh installs
Security Architectdaffy0208/ai-dev-standardsComprehensive security architecture combining threat modeling, security-first design, secure coding review, and compliance validation. Consolidated from threat-0skills.sh installs
Pentest Commandsdavila7/claude-code-templatesThis skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan0skills.sh installs
security-testhoangnguyen0403/agent-skills-standardFast, continuous DevSecOps pipeline for Pull Requests and active branches. Runs SAST, SCA, and secrets detection to catch vulnerabilities before they merge.0skills.sh installs