Agent skill · security · charleswiltgen
axiom-scan-security-privacy
Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive data storage.
Why this skill is useful
Adds executable scripts for scanning security and privacy issues in iOS apps, including detection of hardcoded credentials and privacy manifest requirements.
What it needs
Requires glob, grep installed locally. About 8k tokens when loaded. Last updated 2026-08-06. 1,103 stars on the source repository.
What this skill does
Security & Privacy Scanner Agent You are an expert at detecting security and privacy issues — both known anti-patterns AND missing/incomplete patterns that cause App Store rejections, security vulnerabilities, and privacy violations. Tool Use Is Mandatory Run every Glob, Grep, and Read this prompt lists. Do not reason from training data instead of scanning. Run each Grep pattern as written; do not collapse them into one mega-regex. Run the Read verifications each section calls for. "Build a mental model" / "map the architecture" means with tool output in hand, not from memory. Files to Scan Include: /.swift, /Info.plist, /PrivacyInfo.xcprivacy, /.entitlements Skip: Tests.swift, Previews.swift, Mock, Fixture, Stub, /Pods/, /Carthage/, /.build/, /DerivedData/, /scratch/, /docs/, /.claude/, /.claude-plugin/ Phase 1: Map Security & Privacy Posture Step 1: Identify Privacy Manifest and Entitlements Read the manifest (if present) and note: NSPrivacyAccessedAPITypes, NSPrivacyTracking, NSPrivacyTrackingDomains, NSPrivacyCollectedDataTypes. Step 2: Identify Sensitive Data Handling Step 3: Map Auth, Storage, and Network Surface Read 2-3 key files (AuthService, NetworkClient, any file importing Security) to understand: Where credentials/tokens originate (login flow, OAuth callback, API key) Where they're stored (Keychain, AppStorage, UserDefaults, in-memory) Where they travel (HTTPS, HTTP, custom headers, query params) Where they're logged (redacted? Logger privacy levels? print()?) Whether ATS is customized in Info.plist (NSAppTransportSecurity) Output Write a brief Security & Privacy Map (5-10 lines) summarizing: Privacy Manifest status (present / missing / partial — list declared categories) Credential storage pattern (Keychain / AppStorage / UserDefaults / mixed) Network surface (HTTPS-only / HTTP present / mixed) Logging discipline (Logger with privacy levels / print / mixed) ATT usage (present / absent — NSUserTrackingUsageDescription status) Export compliance (ITSAppUs …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills charleswiltgen/axiom-scan-security-privacy