Capacitor Security
This skill helps you run security audits on Capacitor and Ionic apps using Capsec, a zero-config scanner that checks for 63+ vulnerabilities across secrets, storage, network, and platform-specific issues. You'd reach for this when hardening a mobile app before release, adding security scanning to CI/CD, or hunting down hardcoded API keys and insecure storage patterns. It covers the full spectrum from critical issues like cleartext traffic and exposed secrets to lower-severity problems like debug mode in production. The examples show actual fixes for common mistakes like storing tokens in localStorage instead of Keychain, which makes this more useful than just knowing something is wrong.
- skills.sh installs
- 1.3K
- GitHub stars
- 77
- last updated
- Aug 21, 2026
Install
$ npx -y skills add cap-go/capgo-skills --skill capacitor-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Capacitor Security
Audit and harden the app layer of a Capacitor app: secrets in the bundle, on-device storage, network transport, WebView and native bridge exposure, and platform manifests.
When to Use
TRIGGER when:
- The user asks for a security audit, OWASP Mobile Top 10 / MASVS review, or wants to fix pentest findings.
- The user wants to run or interpret
@capgo/capgo-sec(capsec) results, rule IDs such asSEC001,STO002,NET003,CAP004,AND004,IOS001. - API keys, service-role keys, or
.envvalues appear insrc/,dist/,www/, orcapacitor.config.*. - Auth tokens are stored with
Preferences.set,localStorage, IndexedDB, or plain SQLite. capacitor.config.*containsserver.cleartext: true,server.url, broadserver.allowNavigation,android.allowMixedContent, orwebContentsDebuggingEnabled: true.- Native files contain
NSAllowsArbitraryLoads,android:usesCleartextTraffic="true",android:allowBackup="true",android:debuggable, or exported components without permissions. - The user needs certificate pinning, a Content Security Policy, screenshot protection, or root/jailbreak detection.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/cap-go/capgo-skills
- Categories
- Backend & APIs, Security, Documentation, Mobile Development
- First seen
- Jun 3, 2026
More from cap-go/capgo-skills
All 41- Capacitor Accessibility1.3K
- Capacitor Performance1.3K
- Capacitor App Store1.2K
- Capacitor Splash Screen1.2K
- Capacitor Push Notifications1.2K
- Capacitor Offline First1.1K
- Capacitor Keyboard1.1K
- Capacitor Ci Cd1K
- Tailwind Capacitor1K
- Capacitor Mcp961
- Capacitor Apple Review Preflight956
- Framework To Capacitor912
- Capgo Live Updates897
- Konsta Ui874
- Cocoapods To Spm836
- Capacitor App Upgrades815
- Cordova To Capacitor807
- Capgo Cli Usage773
- Capacitor Plugin Upgrades772
- Capacitor Plugin Spm Support756
- Capgo Native Builds754
- Capgo Release Management749
- Capgo Release Workflows749
- Sqlite To Fast Sql749
Recommended
More Backend & APIs
safe-action-clientnext-safe-action/skillsUse when creating or configuring a next-safe-action client, defining actions with input/output validation, handling server errors, or setting up createSafeActio1.2Kskills.sh installs
shopify-contentjezweb/claude-skillsCreate and manage Shopify pages, blog posts, navigation menus, redirects, and SEO metadata via the Admin API or browser automation. Use whenever the user wants 1.2Kskills.sh installssafe-action-advancednext-safe-action/skillsUse when working with bind arguments, metadata schemas, framework errors (redirect/notFound/forbidden/unauthorized), type inference utilities (InferSafeActionFn1.2Kskills.sh installs
vtex-io-app-settingsvtex/skillsApply when defining, validating, or consuming VTEX IO app settings. Covers settingsSchema, app-level configuration boundaries, and how backend or frontend code 1.2Kskills.sh installs
senior-architectdavila7/claude-code-templatesComprehensive software architecture skill for designing scalable, maintainable systems using ReactJS, NextJS, NodeJS, Express, React Native, Swift, Kotlin, Flut1.2Kskills.sh installs
sap-fiori-toolssecondsky/sap-skillsDevelops SAP Fiori applications using SAP Fiori tools extensions for VS Code and SAP Business Application Studio. Use when: generating Fiori Elements or Freesty1.2Kskills.sh installs