swift-security

dpearson2699/swift-ios-skillsSecurityAudit passedSnapshot 46e7f2e34bfd

Summary

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

SKILL.md

Swift Security

Use this skill for client-side Apple platform security work: Keychain Services, access control, biometric-gated secrets, CryptoKit, Secure Enclave keys, credential storage, certificate trust, keychain sharing, legacy secret migration, security testing, and OWASP mobile compliance mapping.

Default to iOS 17+ and Swift concurrency examples when the deployment target is unknown. Keep iOS 13+ compatibility notes when the user asks for older targets. Treat iOS 26 CryptoKit post-quantum APIs as availability-gated.

Workflow
Reference Loading
Security Invariants
Sibling Boundaries
Review Checklist
Common Mistakes
Output Rules
References

Workflow

Classify the request before loading references.

Review existing code: run the Review Checklist, then load common-anti-patterns.md plus the domain reference for each failing area. Report severity, evidence, and the corrected pattern.
Improve or migrate code: identify the migration type, load the migration and target-domain references, preserve existing data, verify the new item, then remove legacy storage only after success.
Implement new security code: load the minimum domain references, use the provided correct patterns, include OSStatus handling and tests, then run the relevant checklist.

Do not load every reference file by default. This skill is intentionally split for progressive disclosure; load only the files needed by the user's task.

func saveSecret(_ data: Data, account: String) throws {
    let identity: [CFString: Any] = [
        kSecClass: kSecClassGenericPassword,
        kSecAttrService: "com.example.app",
        kSecAttrAccount: account,
    ]
    var add = identity
    add[kSecValueData] = data
    add[kSecAttrAccessible] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly

    switch SecItemAdd(add as CFDictionary, nil) {
    case errSecSuccess:
        return
    case errSecDuplicateItem:
        let status = SecItemUpdate(
            identity as CFDictionary,
            [kSecValueData: data] as CFDictionary
        )
        guard status == errSecSuccess else { throw KeychainError(status: status) }
    case let status:
        throw KeychainError(status: status)
    }
}

If the task involves	Load
General keychain CRUD or OSStatus handling	keychain-fundamentals.md
Choosing `kSecClass` or item identity	keychain-item-classes.md
Accessibility classes or `SecAccessControl`	keychain-access-control.md
Face ID, Touch ID, or biometric-gated secrets	biometric-authentication.md
Secure Enclave keys	secure-enclave.md
Hashing, HMAC, AES-GCM, ChaChaPoly, HKDF, PBKDF2	cryptokit-symmetric.md
Signing, ECDH, HPKE, ML-KEM, ML-DSA	cryptokit-public-key.md
OAuth tokens, API keys, logout, refresh rotation	credential-storage-patterns.md
App/extension keychain sharing	keychain-sharing.md
Certificate trust, SPKI pinning, mTLS	certificate-trust.md
UserDefaults/plist/NSCoding migration	migration-legacy-stores.md
Unit, integration, simulator, device, or CI tests	testing-security-code.md
OWASP MASVS/MASTG or enterprise audit mapping	compliance-owasp-mapping.md
Full security review	common-anti-patterns.md, then each touched domain reference

swift-security

Summary

SKILL.md

Swift Security

Contents

Workflow

Minimum Safe Keychain Write

Reference Loading

Security Invariants

Sibling Boundaries

Review Checklist

Common Mistakes

Output Rules

References

Related skills