swift-security-expert

Name: swift-security-expert
Author: ivan-magda

612installs1forks

How to install swift-security-expert?

ivan-magda/swift-security-skill/swift-security-expert

$npx -y skills add ivan-magda/swift-security-skill --skill swift-security-expert

Installs into the current project.

Summary

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys)

Files · 1

View on GitHub

SKILL.md

1	# Keychain & Security Expert Skill
2
3	> Philosophy: Non-opinionated, correctness-focused. This skill provides facts, verified patterns, and Apple-documented best practices — not architecture mandates. It covers iOS 13+ as a minimum deployment target, with modern recommendations targeting iOS 17+ and forward-looking guidance through iOS 26 (post-quantum). Every code pattern is grounded in Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and OWASP MASTG — never from memory alone.
4	>
5	> What this skill is: A reference for reviewing, improving, and implementing keychain operations, biometric authentication, CryptoKit cryptography, credential lifecycle management, certificate trust, and compliance mapping on Apple platforms.
6	>
7	> What this skill is not: A networking guide, a server-side security reference, or an App Transport Security manual. TLS configuration, server certificate management, and backend auth architecture are out of scope except where they directly touch client-side keychain or trust APIs.
8
9	---
10
11	## Decision Tree
12
13	Determine the user's intent, then follow the matching branch. If ambiguous, ask.
14
15	```
16	┌─────────────────────┐
17	│ What is the task? │
18	└─────────┬───────────┘
19	┌──────────────────┼──────────────────┐
20	▼ ▼ ▼
21	┌─────────┐ ┌───────────┐ ┌────────────┐
22	│ REVIEW │ │ IMPROVE │ │ IMPLEMENT │
23	│ │ │ │ │ │
24	│ Audit │ │ Migrate / │ │ Build from │
25	│ existing│ │ modernize │ │ scratch │
26	│ code │ │ existing │ │ │
27	└────┬────┘ └─────┬─────┘ └─────┬──────┘
28	│ │ │
29	▼ ▼ ▼
30	Run Top-Level Identify gap Identify which
31	Review Checklist (legacy store? domain(s) apply,
32	(§ below) against wrong API? load reference
33	the code. missing auth?) file(s), follow
34	Flag each item Load migration + ✅ patterns.
35	as ✅ / ❌ / domain-specific Implement with
36	⚠️ N/A. reference files. add-or-update,
37	For each ❌, Follow ✅ patterns, proper error
38	cite the verify with domain handling, and
39	reference file checklist. correct access
40	and specific control from
41	section. the start.
42	```
43
44	---
45
46	### Branch 1 — REVIEW (Audit Existing Code)
47
48	Goal: Systematically evaluate existing keychain/security code for correctness, security, and compliance.
49
50	Procedure:
51
52	1. Run the Top-Level Review Checklist (below) against the code under review. Score each item ✅ / ❌ / ⚠️ N/A.
53	2. For each ❌ failure, load the cited reference file and locate the specific anti-pattern or correct pattern.
54	3. Cross-check anti-patterns — scan code against all 10 entries in `common-anti-patterns.md`. Pay special attention to: `UserDefaults` for secrets (#1), hardcoded keys (#2), `LAContext.evaluatePolicy()` as sole auth gate (#3), ignored `OSStatus` (#4).
55	4. Check compliance — if the project requires OWASP MASVS or enterprise audit readiness, map findings to `compliance-owasp-mapping.md` categories M1, M3, M9, M10.
56	5. Report format: For each finding, state: what's wrong → which reference file covers it → the ✅ correct pattern → severity (CRITICAL / HIGH / MEDIUM).
57
58	Key reference files for review:
59
60	- Start with: `common-anti-patterns.md` (backbone — covers 10 most dangerous patterns)
61	- Then domain-specific files based on what the code does
62	- Finish with: `compliance-owasp-mapping.md` (if compliance is relevant)
63
64	---
65
66	### Branch 2 — IMPROVE (Migrate / Modernize)
67
68	Goal: Upgrade existing code from insecure storage, deprecated APIs, or legacy patterns to current best practices.
69
70	Procedure:
71
72	1. Identify the migration type:
73	- Insecure storage → Keychain: Load `migration-legacy-stores.md` + `credential-storage-patterns.md`
74	- Legacy Security framework → CryptoKit: Load `cryptokit-symmetric.md` or `cryptokit-public-key.md` + `migration-legacy-stores.md`
75	- RSA → Elliptic Curve: Load `cryptokit-public-key.

People who liked this also viewed

6 picks

Type

swift-security-expert

612installs1forks

View on GitHub

How to install swift-security-expert?

ivan-magda/swift-security-skill/swift-security-expert

$npx -y skills add ivan-magda/swift-security-skill --skill swift-security-expert

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Keychain & Security Expert Skill
2
3	> Philosophy: Non-opinionated, correctness-focused. This skill provides facts, verified patterns, and Apple-documented best practices — not architecture mandates. It covers iOS 13+ as a minimum deployment target, with modern recommendations targeting iOS 17+ and forward-looking guidance through iOS 26 (post-quantum). Every code pattern is grounded in Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and OWASP MASTG — never from memory alone.
4	>
5	> What this skill is: A reference for reviewing, improving, and implementing keychain operations, biometric authentication, CryptoKit cryptography, credential lifecycle management, certificate trust, and compliance mapping on Apple platforms.
6	>
7	> What this skill is not: A networking guide, a server-side security reference, or an App Transport Security manual. TLS configuration, server certificate management, and backend auth architecture are out of scope except where they directly touch client-side keychain or trust APIs.
8
9	---
10
11	## Decision Tree
12
13	Determine the user's intent, then follow the matching branch. If ambiguous, ask.
14
15	```
16	┌─────────────────────┐
17	│ What is the task? │
18	└─────────┬───────────┘
19	┌──────────────────┼──────────────────┐
20	▼ ▼ ▼
21	┌─────────┐ ┌───────────┐ ┌────────────┐
22	│ REVIEW │ │ IMPROVE │ │ IMPLEMENT │
23	│ │ │ │ │ │
24	│ Audit │ │ Migrate / │ │ Build from │
25	│ existing│ │ modernize │ │ scratch │
26	│ code │ │ existing │ │ │
27	└────┬────┘ └─────┬─────┘ └─────┬──────┘
28	│ │ │
29	▼ ▼ ▼
30	Run Top-Level Identify gap Identify which
31	Review Checklist (legacy store? domain(s) apply,
32	(§ below) against wrong API? load reference
33	the code. missing auth?) file(s), follow
34	Flag each item Load migration + ✅ patterns.
35	as ✅ / ❌ / domain-specific Implement with
36	⚠️ N/A. reference files. add-or-update,
37	For each ❌, Follow ✅ patterns, proper error
38	cite the verify with domain handling, and
39	reference file checklist. correct access
40	and specific control from
41	section. the start.
42	```
43
44	---
45
46	### Branch 1 — REVIEW (Audit Existing Code)
47
48	Goal: Systematically evaluate existing keychain/security code for correctness, security, and compliance.
49
50	Procedure:
51
52	1. Run the Top-Level Review Checklist (below) against the code under review. Score each item ✅ / ❌ / ⚠️ N/A.
53	2. For each ❌ failure, load the cited reference file and locate the specific anti-pattern or correct pattern.
54	3. Cross-check anti-patterns — scan code against all 10 entries in `common-anti-patterns.md`. Pay special attention to: `UserDefaults` for secrets (#1), hardcoded keys (#2), `LAContext.evaluatePolicy()` as sole auth gate (#3), ignored `OSStatus` (#4).
55	4. Check compliance — if the project requires OWASP MASVS or enterprise audit readiness, map findings to `compliance-owasp-mapping.md` categories M1, M3, M9, M10.
56	5. Report format: For each finding, state: what's wrong → which reference file covers it → the ✅ correct pattern → severity (CRITICAL / HIGH / MEDIUM).
57
58	Key reference files for review:
59
60	- Start with: `common-anti-patterns.md` (backbone — covers 10 most dangerous patterns)
61	- Then domain-specific files based on what the code does
62	- Finish with: `compliance-owasp-mapping.md` (if compliance is relevant)
63
64	---
65
66	### Branch 2 — IMPROVE (Migrate / Modernize)
67
68	Goal: Upgrade existing code from insecure storage, deprecated APIs, or legacy patterns to current best practices.
69
70	Procedure:
71
72	1. Identify the migration type:
73	- Insecure storage → Keychain: Load `migration-legacy-stores.md` + `credential-storage-patterns.md`
74	- Legacy Security framework → CryptoKit: Load `cryptokit-symmetric.md` or `cryptokit-public-key.md` + `migration-legacy-stores.md`
75	- RSA → Elliptic Curve: Load `cryptokit-public-key.

People who liked this also viewed

6 picks

Type