Swift Security Expert

This is a comprehensive reference system for iOS and macOS security work, built around a three-branch decision tree: review existing code against checklists, migrate legacy patterns to modern APIs, or implement from scratch using verified patterns. It covers Keychain Services, biometric auth, CryptoKit, Secure Enclave, and certificate pinning with direct citations to Apple documentation, Quinn's DTS posts, WWDC sessions, and OWASP MASTG. The philosophy is explicitly non-opinionated but correctness-focused, meaning it won't argue architecture with you but will tell you exactly which OSStatus codes you're ignoring and why your UserDefaults token storage is a critical finding. Targets iOS 13+ with forward-looking guidance through post-quantum iOS 26. Useful if you're doing security audits, migrating secrets out of plists, or need to justify decisions to compliance teams.

skills.sh installs: 875
GitHub stars: 40
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ivan-magda/swift-security-skill --skill swift-security-expert --agent claude-code

Installs into .claude/skills of the current project.

Files

Keychain & Security Expert Skill

Philosophy: Non-opinionated, correctness-focused. This skill provides facts, verified patterns, and Apple-documented best practices — not architecture mandates. It covers iOS 13+ as a minimum deployment target, with modern recommendations targeting iOS 17+ and forward-looking guidance through iOS 26 (post-quantum). Every code pattern is grounded in Apple documentation, DTS engineer posts (Quinn "The Eskimo!"), WWDC sessions, and OWASP MASTG — never from memory alone.

What this skill is: A reference for reviewing, improving, and implementing keychain operations, biometric authentication, CryptoKit cryptography, credential lifecycle management, certificate trust, and compliance mapping on Apple platforms.

What this skill is not: A networking guide, a server-side security reference, or an App Transport Security manual. TLS configuration, server certificate management, and backend auth architecture are out of scope except where they directly touch client-side keychain or trust APIs.