Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.
Swift Security is a defensive, client-side security reference skill for Apple platform development. It covers Keychain Services (SecItem queries, kSecClass, OSStatus handling), access control and accessibility classes, biometric-gated secrets via LAContext (Face ID / Touch ID), CryptoKit symmetric and public-key cryptography, Secure Enclave keys, secure credential storage for OAuth tokens and API keys, certificate trust and SPKI pinning, keychain sharing across apps and extensions, and migration of secrets out of insecure stores like UserDefaults or plists. It also maps work to OWASP MASVS/MASTG mobile compliance. The problem it solves is that AI-generated and hand-written iOS security code frequently gets subtle but critical details wrong, so the skill encodes verified correct patterns.
The skill is deliberately split into progressive-disclosure reference files and directs the agent to classify the request first, then load only the minimum references needed. It defines three workflows — reviewing existing code against a checklist and anti-patterns, migrating or improving code while preserving existing data and verifying before removing legacy storage, and implementing new security code with full OSStatus handling and tests. It includes concrete correct-pattern examples such as a minimum safe keychain write using separate add/identity/update dictionaries and appropriate accessibility flags, plus a reference-loading table mapping tasks to files (keychain fundamentals, item classes, access control, biometrics, Secure Enclave, CryptoKit symmetric and public-key, credential storage, sharing, certificate trust, migration, testing, and OWASP mapping). It defaults to iOS 17+ with Swift concurrency and treats iOS 26 post-quantum CryptoKit APIs as availability-gated.
Target users are iOS and macOS engineers building or reviewing security-sensitive code, and teams pursuing mobile security compliance. It is entirely guidance and correct-usage reference material focused on protecting secrets and using platform cryptography properly.
Apple platforms (iOS/macOS). It defaults to iOS 17+ with Swift concurrency examples, keeps iOS 13+ compatibility notes when asked, and treats iOS 26 post-quantum CryptoKit APIs as availability-gated.
As progressive-disclosure reference files. You classify the task first, then load only the specific references needed (keychain, biometrics, CryptoKit, Secure Enclave, certificate trust, migration, testing, or OWASP mapping).
Yes. One workflow runs a review checklist plus a common-anti-patterns reference and reports severity, evidence, and the corrected pattern for each failing area.
Yes. A migration workflow preserves existing data, writes to the secure store, verifies the new item, and only then removes the legacy storage.
It maps implementations to OWASP MASVS/MASTG mobile security requirements via a dedicated compliance reference.
Quick Setup:
.claude/skills/Repository
dpearson2699/swift-ios-skills