The problem
Coding agents write mobile code fast but forget the rules that keep an app fast and safe: tokens end up in AsyncStorage, lists render thousands of rows, sign-out leaves the last user's data behind. Existing skills explain Expo APIs; none tell you whether the app is ready for production.
Approach
Built a Claude Code plugin with 9 skills, 9 agents and a real-time guard hook. A zero-dependency scanner collects facts locally; in deep mode 8 specialist auditors run in parallel and an adversarial verifier tries to disprove every serious finding. It covers performance, MMKV and secure storage, auth and sessions, Supabase RLS or API security, dependencies, SDK upgrades and store privacy forms, and writes per-folder CLAUDE.md rules for agents.
Outcome
One command gives a scored report with file:line evidence, a GO / NO-GO verdict and a trend across audits. The fix skill only reports success after gates, an independent re-check of each finding and a re-audit pass.
Metrics
- 13Audit categories
- 120+Detection rules
- 9 · 9Skills · agents