Agent skill · security · dpearson2699
swift-security
Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.
Why this skill is useful
Adds executable security patterns and compliance workflows for iOS/macOS that are not commonly known or documented.
What it needs
About 6k tokens when loaded. Last updated 2026-07-31. 973 stars on the source repository.
What this skill does
Swift Security Use this skill for client-side Apple platform security work: Keychain Services, access control, biometric-gated secrets, CryptoKit, Secure Enclave keys, credential storage, certificate trust, keychain sharing, legacy secret migration, security testing, and OWASP mobile compliance mapping. Default to iOS 17+ and Swift concurrency examples when the deployment target is unknown. Keep iOS 13+ compatibility notes when the user asks for older targets. Treat iOS 26 CryptoKit post-quantum APIs as availability-gated. Contents Workflow Reference Loading Security Invariants Sibling Boundaries Review Checklist Common Mistakes Output Rules References Workflow Classify the request before loading references. 1. Review existing code: run the Review Checklist, then load common-anti-patterns.md plus the domain reference for each failing area. Report severity, evidence, and the corrected pattern. 2. Improve or migrate code: identify the migration type, load the migration and target-domain references, preserve existing data, verify the new item, then remove legacy storage only after success. 3. Implement new security code: load the minimum domain references, use the provided correct patterns, include OSStatus handling and tests, then run the relevant checklist. Do not load every reference file by default. This skill is intentionally split for progressive disclosure; load only the files needed by the user's task. Minimum Safe Keychain Write Use separate add, identity, and update dictionaries; handle every OSStatus: Load keychain-fundamentals.md for read, delete, access-control, locked-device, and test patterns. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills dpearson2699/swift-security