skills.rest
Roy-wonji
Roy-wonjiCOMMUNITY
Explore all skills by this author →
GitHub

swift-security-expert

Audit and implement iOS/macOS Keychain, biometric, and CryptoKit security code.

Updated May 6, 2026
Search Tags:#security review#biometrics#keychain#certificate pinning#cryptokit#oauth tokens#owasp masvs
One-click install
npx skills add https://github.com/Roy-wonji/claude-config --skill swift-security-expert-roy-wonji
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: swift-security-expert
Source: https://github.com/Roy-wonji/claude-config/tree/main/skills/swift-security-expert
Command: npx skills add https://github.com/Roy-wonji/claude-config --skill swift-security-expert-roy-wonji

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents insecure and incorrect iOS/macOS security implementations by guiding correct Keychain Services usage, biometric authentication patterns, CryptoKit cryptography, certificate trust/pinning, and secure credential lifecycles.

Core Features & Use Cases

  • Keychain & Access Control Review: Audit SecItem* code for correctness, OSStatus handling, accessibility configuration, and add-or-update semantics, with security-focused findings and severities.
  • Biometric Security That Actually Works: Replace insecure LAContext.evaluatePolicy() boolean gates with keychain-bound SecAccessControl flows using .biometryCurrentSet and proper error/fallback handling.
  • CryptoKit + Trust/Pinning Guidance: Implement safe symmetric/asymmetric crypto (AES-GCM/ChaChaPoly, HKDF, HPKE, Secure Enclave boundaries) and certificate validation/pinning using modern, non-deprecated APIs.
  • Credential Lifecycle & Compliance Mapping: Store OAuth/API secrets safely, migrate legacy insecure storage, clear credentials on logout, and map outcomes to OWASP MASVS/MASTG categories.

Quick Start

Use this skill when you need to review or implement Keychain, biometric, or client-side crypto code; ask: "Review my Swift Keychain and biometric authentication code for correctness and security anti-patterns, then tell me the exact fixes and the relevant reference sections."

Frequently Asked Questions about swift-security-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely implement biometric authentication in Swift without using insecure LAContext boolean gates?▼

Secure Swift Keychain storage requires exhaustive OSStatus handling, explicit accessibility configuration, and correct add-or-update semantics for `SecItem*` operations. You must enforce thread isolation away from @MainActor and prohibit insecure storage patterns to ensure secrets remain protected.

What is the correct way to handle Keychain SecItem operations and OSStatus errors in iOS?▼

Correct Keychain SecItem operations require exhaustive OSStatus handling, explicit accessibility configuration, and proper add-or-update semantics. You must enforce thread isolation away from @MainActor to prevent race conditions and ensure secure credential lifecycle management.

How do I implement certificate pinning and CryptoKit cryptography using non-deprecated APIs?▼

CryptoKit cryptography and certificate pinning implementation should use modern, non-deprecated APIs for symmetric/asymmetric crypto like AES-GCM, ChaChaPoly, HKDF, and HPKE. Proper trust validation patterns and Secure Enclave boundaries are required to mitigate client-side threats effectively.

How do I securely store OAuth tokens and map iOS security code to OWASP MASVS compliance?▼

Securely storing OAuth tokens in iOS requires migrating secrets from insecure stores to Keychain, managing credential lifecycles by clearing data on logout, and mapping security outcomes to OWASP MASVS/MASTG categories. This ensures API secrets are protected and compliant with mobile security standards.

Does this Swift security review tool support auditing existing Keychain code for insecure storage patterns?▼

This Swift security review tool audits existing `SecItem*` usage for correctness, exhaustive OSStatus handling, and explicit accessibility configuration. It identifies insecure storage patterns, assigns severity levels to findings, and guides the migration of legacy secrets to secure Keychain-bound implementations.

What are common Swift Keychain anti-patterns and limitations when migrating insecure credential stores?▼

Common Swift Keychain anti-patterns include insecure LAContext boolean gating, ignoring OSStatus errors, and lacking explicit accessibility configurations. When migrating insecure credential stores, enforce correct add-or-update semantics and thread isolation away from @MainActor to prevent data corruption and security bypasses.

Related Skills

Explore More Software Engineering Skills→
jitraponjitrapon
11

audit-xcode-security-settings

Audit Xcode security build settings and entitlements across Apple platforms.

Community
Advanced
curtislmartincurtislmartin

swift-security-expert

Identify insecure patterns in iOS/macOS Keychain and biometric authentication code.

Community
Advanced
achmfachmf

vulnerability-scanner

Scan software projects for vulnerabilities, hardcoded secrets, and insecure code patterns.

Community
Advanced
jperezdelrealjperezdelreal

swift-security-expert

Audit and implement Keychain, biometrics, and CryptoKit security patterns on Apple platforms.

Community
Advanced