CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

swift-security

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is dpearson2699/swift-ios-skills

SKILL.md
Quality
Evals
Security

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary SKILL.md body: directive, dense with security invariants, a fully executable reference example, validation-gated migration workflow, and textbook progressive disclosure across a real, verified reference bundle. The only trimmable redundancy is the double enumeration of the reference files in both the Reference Loading table and the References catalog.

Suggestions

Merge the Reference Loading table and the References catalog into a single table with columns for trigger and one-line purpose, eliminating the duplicate 14-file enumeration and saving roughly 20 lines.

Consider trimming the Contents TOC (8 anchors) since the body is short enough for section headers to serve as navigation, further reducing token overhead.

Define or briefly stub KeychainError in the inline example (one line) so the sample code is fully self-contained without needing a reference file.

DimensionReasoningScore

Conciseness

The body is lean and directive — no concept explanations Claude already knows, one compact code example, and dense invariants/checklists that earn their tokens. It falls short of anchor 5 only because the 14 reference files are enumerated twice in full (the Reference Loading table and the References catalog), a duplication that could be merged into one mapping. Not 3 because nothing is padded or over-explained.

4 / 5

Actionability

The 'Minimum Safe Keychain Write' is a complete, copy-paste-ready Swift function with full OSStatus branching (errSecSuccess / errSecDuplicateItem / default), and the surrounding guidance is concrete: a task→file decision table, an explicit severity taxonomy (CRITICAL/HIGH/MEDIUM), and per-item review checks. This matches anchor 5; the only trivially minor gap (KeychainError is referenced but not defined) does not reduce executability given the rubric's instruction to assume Claude's competence.

5 / 5

Workflow Clarity

The Workflow section classifies requests into three numbered paths, and the migration path includes an explicit validation checkpoint before a destructive step ('preserve existing data, verify the new item, then remove legacy storage only after success'). The Review Checklist supplies a per-item pass/fail checklist, matching anchor 5's 'explicit validation steps; checklists for complex processes'. The destructive-operation cap at 3 does not apply because validation-before-removal is explicitly sequenced.

5 / 5

Progressive Disclosure

The body is a lean overview that explicitly instructs 'Do not load every reference file by default', provides a task→file mapping table for navigation, and pushes all detail into 14 one-level-deep reference files that all exist on disk (verified against references/, e.g. keychain-fundamentals.md with its own scoped contents). This matches anchor 5: clear overview, well-signaled one-level-deep references, easy navigation.

5 / 5

Total

19

/

20

Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, trigger-rich description with excellent natural keyword coverage and a clearly delineated niche. Its only weakness is that the skill's capabilities are implied by the enumerated work areas rather than explicitly stated as actions, leaving the 'what' slightly less explicit than the 'when'.

Suggestions

Open with a brief statement of what the skill does before the trigger clause, e.g. 'Review, implement, and migrate client-side Apple platform security code. Use when working with…', so the 'what' is explicit rather than implied by enumeration.

Add one or two action verbs to the enumerated areas (e.g. 'storing OAuth tokens and API keys securely', 'migrating secrets out of UserDefaults') to state capabilities as actions, which would lift completeness to a 5.

Optionally include file-format/alias terms users might type (e.g. 'keychain', 'entitlements', 'access groups') alongside the API names to broaden natural-trigger coverage, though current coverage is already strong.

DimensionReasoningScore

Specificity

The description names concrete APIs in every clause — 'SecItem queries, kSecClass, OSStatus errors', 'AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM', 'SecTrust, SPKI' — giving comprehensive, specific coverage of the domain rather than vague language. It exceeds anchor 4 ('several specific actions; minor gaps') because no sub-area of the skill's scope is left unnamed.

5 / 5

Completeness

The 'when' is fully explicit ('Use when working with iOS/macOS Keychain Services… migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance') with concrete trigger phrases, but the 'what' is only conveyed implicitly through the enumerated working areas — no action verb states what the skill does (e.g., 'review, implement, and migrate'). It fits anchor 4 ('both what and when; when could be more explicit' — here the inverse: what could be more explicit) rather than 5, and is above 3 because the enumeration clearly communicates the skill's scope.

4 / 5

Trigger Term Quality

It covers the natural terms users would actually say — 'Keychain', 'Face ID', 'Touch ID', 'OAuth tokens', 'API keys', 'UserDefaults', 'certificate pinning' — alongside technical synonyms and API names, matching the anchor-5 pattern of comprehensive coverage including synonyms. Not 4 because no common variation of these triggers is missing.

5 / 5

Distinctiveness Conflict Risk

It carves a clear niche — client-side Apple platform security (Keychain, Secure Enclave, CryptoKit in a storage/trust context, MASVS/MASTG) — with distinct triggers that would not fire for generic Swift, networking, or App Review skills. Minimal conflict risk, matching anchor 5.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

dpearson2699/swift-ios-skills

Path

skills/swift-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.