Swift Security Skill

Swift Security Expert

An AI agent skill for secure credential storage and cryptography on Apple platforms: Keychain Services, biometric authentication, CryptoKit, Secure Enclave, certificate trust, and OWASP compliance for iOS, macOS, tvOS, watchOS, and visionOS (iOS 13 through 26+).

Table of Contents

• Background
• Philosophy
• Features
• Installation
• Usage
• Project Structure
• Contributing
• License

Background

AI coding assistants are unreliable on Apple security code. They reach for `UserDefaults` to hold tokens, gate access on a patchable `LAContext.evaluatePolicy()` boolean, drop `OSStatus` return codes on the floor, and reuse AES-GCM nonces. Each of these is a real vulnerability, not a style problem.

This skill gives an agent the defaults and review guidance it needs to avoid those mistakes. It covers reviewing existing Swift security code, modernizing legacy storage, and implementing Keychain, biometric, and CryptoKit features from scratch. The guidance comes from Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and the OWASP MASTG rather than from the model's own recall.

Philosophy

• Non-opinionated. It supplies verified patterns and Apple-documented behavior rather than mandating one architecture. Where several valid options exist (P256 vs Curve25519, AES-GCM vs ChaChaPoly, actor vs serial queue), it presents the tradeoffs and lets you choose.
• Correctness over coverage. Reference files pair correct and incorrect examples and explain why the wrong one fails.
• Grounded. Every non-obvious claim cites Apple docs, a WWDC session, or an OWASP control. The skill does not invent session numbers or version requirements.
• Built for work. It targets review, fixes, and implementation, with a severity rating and an iOS version tag on every recommendation.

Features

The skill co