ivan-magda

Swift Security Skill — Security skill for Claude Code

Security community

AI agent skill for secure credential storage & cryptography on Apple platforms - Keychain Services, biometric auth, CryptoKit, and OWASP compliance (iOS 13–26+).

How to install Swift Security Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ivan-magda/swift-security-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Swift Security Skill does

AI agent skill for secure credential storage & cryptography on Apple platforms - Keychain Services, biometric auth, CryptoKit, and OWASP compliance (iOS 13–26+).

Alternatives in Security

Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
MCP Security Checklist (SlowMist) — Comprehensive checklist: input validation, rate limiting, RBAC, credential management, container hardening 819 ★

README

Swift Security Expert

An AI agent skill for secure credential storage and cryptography on Apple platforms: Keychain Services, biometric authentication, CryptoKit, Secure Enclave, certificate trust, and OWASP compliance for iOS, macOS, tvOS, watchOS, and visionOS (iOS 13 through 26+).

Background
Philosophy
Features
Installation
Usage
Project Structure
Contributing
License

Background

AI coding assistants are unreliable on Apple security code. They reach for `UserDefaults` to hold tokens, gate access on a patchable `LAContext.evaluatePolicy()` boolean, drop `OSStatus` return codes on the floor, and reuse AES-GCM nonces. Each of these is a real vulnerability, not a style problem.

This skill gives an agent the defaults and review guidance it needs to avoid those mistakes. It covers reviewing existing Swift security code, modernizing legacy storage, and implementing Keychain, biometric, and CryptoKit features from scratch. The guidance comes from Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and the OWASP MASTG rather than from the model's own recall.

Philosophy

Non-opinionated. It supplies verified patterns and Apple-documented behavior rather than mandating one architecture. Where several valid options exist (P256 vs Curve25519, AES-GCM vs ChaChaPoly, actor vs serial queue), it presents the tradeoffs and lets you choose.
Correctness over coverage. Reference files pair correct and incorrect examples and explain why the wrong one fails.
Grounded. Every non-obvious claim cites Apple docs, a WWDC session, or an OWASP control. The skill does not invent session numbers or version requirements.
Built for work. It targets review, fixes, and implementation, with a severity rating and an iOS version tag on every recommendation.