skills.rest
ivan-magda
ivan-magdaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

swift-security-expert

Review Swift code for Apple platform security anti-patterns and remediation.

30|1|Updated Mar 5, 2026
Search Tags:#secure coding#swift#cryptography#biometrics#keychain#ios security#apple platform
One-click install
npx skills add https://github.com/ivan-magda/swift-security-skill --skill swift-security-expert
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: swift-security-expert
Source: https://github.com/ivan-magda/swift-security-skill/tree/main/swift-security-expert
Command: npx skills add https://github.com/ivan-magda/swift-security-skill --skill swift-security-expert

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the common issue of AI-generated code producing insecure security practices on Apple platforms, particularly around Keychain, biometrics, and cryptography.

Core Features & Use Cases

  • Secure Credential Storage: Implement Keychain Services correctly for tokens, keys, and passwords.
  • Biometric Authentication: Securely integrate Face ID and Touch ID, avoiding bypass vulnerabilities.
  • CryptoKit Best Practices: Utilize modern Swift cryptography for encryption, signing, and key management.
  • Use Case: Review Swift code for common security anti-patterns like storing secrets in UserDefaults, using LAContext.evaluatePolicy() alone for authentication, or ignoring OSStatus codes, and replace them with Apple's recommended secure patterns.

Quick Start

Use the swift security expert skill to review the current security code for authentication bypasses, credential storage issues, and cryptographic correctness.

Frequently Asked Questions about swift-security-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I avoid LAContext bypass vulnerabilities in Swift biometric authentication?▼

Secure Keychain Services credential storage requires correctly handling OSStatus codes and avoiding common anti-patterns like storing tokens or passwords in UserDefaults. Replace these with Apple's recommended Keychain patterns for secure data persistence.

How do I select the correct CryptoKit algorithms for Swift encryption and signing?▼

Selecting correct CryptoKit algorithms for Swift encryption and signing involves utilizing modern Swift cryptography best practices for key management, ensuring cryptographic correctness, and mapping implementations to OWASP MASVS/MASTG standards.

What are common iOS security anti-patterns in AI-generated Swift code?▼

Common iOS security anti-patterns in AI-generated Swift code include storing secrets in UserDefaults, using LAContext.evaluatePolicy() alone for authentication, and ignoring OSStatus codes, which require remediation strategies to fix.

Can I use the Secure Enclave to store hardware-bound secrets for Apple platform security?▼

Yes, you can use the Secure Enclave to implement hardware-bound secrets for Apple platform security. This approach ensures that cryptographic keys remain isolated within dedicated hardware, preventing unauthorized extraction.

What's the best way to map Swift code security findings to OWASP MASVS/MASTG standards?▼

The best way to map Swift code security findings to OWASP MASVS/MASTG standards is to review authentication bypasses, credential storage issues, and cryptographic correctness, then apply targeted remediation strategies based on those standards.

Related Skills

Explore More Software Engineering Skills→
PallepadehatPallepadehat
1

swift-concurrency-expert

Review and remediate Swift 6.2+ concurrency issues with actor isolation and Sendable safety.

Community
Advanced
briiirussellbriiirussell
345

mobile-audit

Audit iOS and Android apps against OWASP MASVS and MASTG.

Community
Advanced
yashpalsince2004yashpalsince2004

swift-security

Guide Swift developers in implementing keychain security, biometric authentication, CryptoKit, and certificate pinning.

Community
Advanced
fakhriaditiarahmanfakhriaditiarahman
1

mobile-security-coder

Provides mobile-specific security coding for WebViews, secure storage, authentication, and HTTPS enforcement.

Community
Advanced