audit-xcode-security-settings

Name: audit-xcode-security-settings
Author: superagents-lab

234stars15forks

How to install audit-xcode-security-settings?

superagents-lab/xcode27-skills/audit-xcode-security-settings

$npx -y skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings

Installs into the current project.

Summary

Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode project, audit security settings, enable hardening, review security posture of bu

Files · 1

View on GitHub

SKILL.md

1	# Audit Xcode Security Settings
2
3	Assess an Xcode project's security posture and progressively enable security build settings and entitlements — from broadly applicable warnings through Enhanced Security hardening.
4
5	## Tool Preferences
6
7	When `GetTargetBuildSettings` writes its output to a saved file due to a token limit, see `references/reading-build-settings.md` for the schema and the filter script (`scripts/filter_build_settings.py`). Do not read the saved file linearly.
8
9	When XcodeGlob, XcodeGrep, XcodeRead, and XcodeLS tools are available, ALWAYS use them. Do not fall back to Bash filesystem tools (`ls`, `find`, `cat`, `grep`) to learn about the project. They trigger extra permission prompts and bypass project scoping.
10
11	- XcodeGlob for file discovery — `find` is forbidden for files inside the project.
12	- XcodeGrep for content search — `grep`/`rg` is forbidden for files inside the project.
13	- XcodeRead for file contents — `cat`/`Read` is forbidden for files registered in the project.
14	- XcodeLS for directory listing — `ls` is forbidden for any path inside the project.
15
16	Project root and name are already in the system prompt context. Do NOT run `ls` to "verify" the project layout before starting. The system prompt already tells you the working directory and the project structure.
17
18	Empty XcodeGlob results are not a failure. The `.xcodeproj` and `.xcworkspace` are not indexed as files inside the Xcode project organization — `XcodeGlob "*/.xcodeproj"` correctly returns 0 matches. Use the project name from system-prompt context instead. Do not fall back to filesystem `ls`/`find`.
19
20	Path translation between project-org and filesystem. XcodeGlob returns project-org-relative paths. To read or edit a file:
21	- Prefer `XcodeRead` / `XcodeUpdate` with the project-org path.
22	- If that path is rejected (some on-disk files like `.entitlements` plists may not be navigable through `XcodeRead`), translate to a filesystem absolute path by prepending the project root from system context. Do NOT use `find` to discover the on-disk path.
23
24	Fall back to Bash only for operations the Xcode tools cannot do (e.g., `plutil` for plist editing, git operations).
25
26	### Common Failure Modes
27
28	\| Symptom \| Cause \| Correct Response \|
29	\|---\|---\|---\|
30	\| `XcodeGlob "*/.xcodeproj"` returns 0 matches \| The `.xcodeproj` itself isn't a project-indexed file \| Use the project name from system context; do not fall back to `find` or `ls` \|
31	\| `XcodeRead <project-org-path>` fails for a config-type file (`.entitlements`, `.xcsettings`, `.xcconfig`) \| Some on-disk artifacts aren't navigable via project paths \| Translate to filesystem absolute path using the project root from system context, then use `Read` / `Edit` \|
32
33	## Workflow
34
35	## Phase 0: Discovery
36
37	Read the system prompt context. It contains:
38	- The project root (working directory).
39	- The project name and structure (top-level files, packages).
40	- The active scheme.
41
42	Do not call `ls`, `find`, or any filesystem tool to re-discover this information.
43
44	## Track Progress
45
46	Before starting Phase 1:
47
48	1. Print the workflow plan to the user as a visible bullet list (so non-verbose users can see what's coming):
49
50	> Workflow:
51	> - Phase 1: Analyze project and existing settings
52	> - Phase 2: Apply settings
53	> - Step 1: Enhanced Security
54	> - Step 2: Basic Clang safety warnings
55	> - Phase 3: Inquire about disabled settings
56	> - Phase 4: Validate applied settings
57	> - Phase 5: Report and update decision document
58	> - Phase 6: Optional follow-ups
59
60	2. Call `TaskCreate` with the same items so verbose users get a tracker.
61
62	When entering each phase or sub-step:
63	- Print one line: "▶ Phase N: …" (or "▶ Phase 2 / Step 1: …" for sub-steps).
64	- Update the task to `in_progress`.
65
66	When finishing each phase or sub-step:
67	- Print one line: "✓ Phase N: …" (with a brief outcome if applicable, e.g., "✓ Phase 3: No disabled settings found.").
68	- Update the task to `completed`.
69
70	Phase 6 starts as a single task and a single line. When the user opts into a specific follow-up, print "▶ Phase 6 / <name>" at start and "✓ Phase 6 / <name>" at end, and create/update the corresponding sub-task.
71
72	### Phase 1: Analyze Project and Settings
73
74	No user interaction. Gather facts silently. Prefer XcodeGlob, XcodeGrep, and XcodeRead over Bash equivalents when available (see Tool Preferences).
75
76	1. Find `.xcodeproj` or `.xcworkspa

People who liked this also viewed

6 picks

Type

audit-xcode-security-settings

234stars15forks

View on GitHub

How to install audit-xcode-security-settings?

superagents-lab/xcode27-skills/audit-xcode-security-settings

$npx -y skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Audit Xcode Security Settings
2
3	Assess an Xcode project's security posture and progressively enable security build settings and entitlements — from broadly applicable warnings through Enhanced Security hardening.
4
5	## Tool Preferences
6
7	When `GetTargetBuildSettings` writes its output to a saved file due to a token limit, see `references/reading-build-settings.md` for the schema and the filter script (`scripts/filter_build_settings.py`). Do not read the saved file linearly.
8
9	When XcodeGlob, XcodeGrep, XcodeRead, and XcodeLS tools are available, ALWAYS use them. Do not fall back to Bash filesystem tools (`ls`, `find`, `cat`, `grep`) to learn about the project. They trigger extra permission prompts and bypass project scoping.
10
11	- XcodeGlob for file discovery — `find` is forbidden for files inside the project.
12	- XcodeGrep for content search — `grep`/`rg` is forbidden for files inside the project.
13	- XcodeRead for file contents — `cat`/`Read` is forbidden for files registered in the project.
14	- XcodeLS for directory listing — `ls` is forbidden for any path inside the project.
15
16	Project root and name are already in the system prompt context. Do NOT run `ls` to "verify" the project layout before starting. The system prompt already tells you the working directory and the project structure.
17
18	Empty XcodeGlob results are not a failure. The `.xcodeproj` and `.xcworkspace` are not indexed as files inside the Xcode project organization — `XcodeGlob "*/.xcodeproj"` correctly returns 0 matches. Use the project name from system-prompt context instead. Do not fall back to filesystem `ls`/`find`.
19
20	Path translation between project-org and filesystem. XcodeGlob returns project-org-relative paths. To read or edit a file:
21	- Prefer `XcodeRead` / `XcodeUpdate` with the project-org path.
22	- If that path is rejected (some on-disk files like `.entitlements` plists may not be navigable through `XcodeRead`), translate to a filesystem absolute path by prepending the project root from system context. Do NOT use `find` to discover the on-disk path.
23
24	Fall back to Bash only for operations the Xcode tools cannot do (e.g., `plutil` for plist editing, git operations).
25
26	### Common Failure Modes
27
28	\| Symptom \| Cause \| Correct Response \|
29	\|---\|---\|---\|
30	\| `XcodeGlob "*/.xcodeproj"` returns 0 matches \| The `.xcodeproj` itself isn't a project-indexed file \| Use the project name from system context; do not fall back to `find` or `ls` \|
31	\| `XcodeRead <project-org-path>` fails for a config-type file (`.entitlements`, `.xcsettings`, `.xcconfig`) \| Some on-disk artifacts aren't navigable via project paths \| Translate to filesystem absolute path using the project root from system context, then use `Read` / `Edit` \|
32
33	## Workflow
34
35	## Phase 0: Discovery
36
37	Read the system prompt context. It contains:
38	- The project root (working directory).
39	- The project name and structure (top-level files, packages).
40	- The active scheme.
41
42	Do not call `ls`, `find`, or any filesystem tool to re-discover this information.
43
44	## Track Progress
45
46	Before starting Phase 1:
47
48	1. Print the workflow plan to the user as a visible bullet list (so non-verbose users can see what's coming):
49
50	> Workflow:
51	> - Phase 1: Analyze project and existing settings
52	> - Phase 2: Apply settings
53	> - Step 1: Enhanced Security
54	> - Step 2: Basic Clang safety warnings
55	> - Phase 3: Inquire about disabled settings
56	> - Phase 4: Validate applied settings
57	> - Phase 5: Report and update decision document
58	> - Phase 6: Optional follow-ups
59
60	2. Call `TaskCreate` with the same items so verbose users get a tracker.
61
62	When entering each phase or sub-step:
63	- Print one line: "▶ Phase N: …" (or "▶ Phase 2 / Step 1: …" for sub-steps).
64	- Update the task to `in_progress`.
65
66	When finishing each phase or sub-step:
67	- Print one line: "✓ Phase N: …" (with a brief outcome if applicable, e.g., "✓ Phase 3: No disabled settings found.").
68	- Update the task to `completed`.
69
70	Phase 6 starts as a single task and a single line. When the user opts into a specific follow-up, print "▶ Phase 6 / <name>" at start and "✓ Phase 6 / <name>" at end, and create/update the corresponding sub-task.
71
72	### Phase 1: Analyze Project and Settings
73
74	No user interaction. Gather facts silently. Prefer XcodeGlob, XcodeGrep, and XcodeRead over Bash equivalents when available (see Tool Preferences).
75
76	1. Find `.xcodeproj` or `.xcworkspa

People who liked this also viewed

6 picks

Type