# Swift Security

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus...

- Repository: https://github.com/dpearson2699/swift-ios-skills (1266 stars)
- Category: Security
- License: MIT
- Last updated: 2026-07-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add dpearson2699/swift-ios-skills --skill swift-security -g -a claude-code -y`
Codex: `npx skills add dpearson2699/swift-ios-skills --skill swift-security -g -a codex -y`
Cursor: `npx skills add dpearson2699/swift-ios-skills --skill swift-security -g -a cursor -y`
Gemini CLI: `npx skills add dpearson2699/swift-ios-skills --skill swift-security -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add dpearson2699/swift-ios-skills`

## Description

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Swift Security

Use this skill for client-side Apple platform security work: Keychain Services,
access control, biometric-gated secrets, CryptoKit, Secure Enclave keys,
credential storage, certificate trust, keychain sharing, legacy secret
migration, security testing, and OWASP mobile compliance mapping.

Default to iOS 17+ and Swift concurrency examples when the deployment target is
unknown. Keep iOS 13+ compatibility notes when the user asks for older targets.
Treat iOS 26 CryptoKit post-quantum APIs as availability-gated.

## Contents

- [Workflow](#workflow)
- [Reference Loading](#reference-loading)
- [Security Invariants](#security-invariants)
- [Sibling Boundaries](#sibling-boundaries)
- [Review Checklist](#review-checklist)
- [Common Mistakes](#common-mistakes)
- [Output Rules](#output-rules)
- [References](#references)

## Workflow

Classify the request before loading references.

1. Review existing code: run the [Review Checklist](#review-checklist), then
   load [common-anti-patterns.md](references/common-anti-patterns.md) plus the
   domain reference for each failing area. Report severity, evidence, and the
   corrected pattern.
2. Improve or migrate code: identify the migration type, load the migration
   and target-domain references, preserve existing data, verify the new item,
   then remove legacy storage only after success.
3. Implement new security code: load the minimum domain references, use the
   provided correct patterns, include OSStatus handling and tests, then run the
   relevant checklist.

Do not load every reference file by default. This skill is intentionally split
for progressive disclosure; load only the files needed by the user's task.

### Minimum Safe Keychain Write

Use separate add, identity, and update dictionaries; handle every `OSStatus`:

The rest: https://github.com/dpearson2699/swift-ios-skills/blob/HEAD/skills/swift-security/SKILL.md