CtrlK
BlogDocsLog inGet started
Tessl Logo

swift-security-expert

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

62

1.53x
Quality

65%

Does it follow best practices?

Impact

100%

1.53x

Average score across 1 eval scenario

SecuritybySnyk

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./swift-security-expert/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

47%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a comprehensive and well-structured routing document for Apple platform security, with excellent workflow clarity through its three-branch decision tree and thorough checklists. However, it suffers significantly from verbosity — the same information is repeated across Core Guidelines, Anti-Pattern Detection, Common AI Mistakes, and the Review Checklist, and extensive behavioral/tone rules consume tokens without proportional value. The lack of any executable code in the main file, combined with all 14 referenced bundle files being absent, means the skill functions as an elaborate table of contents rather than a self-contained actionable reference.

Suggestions

Reduce redundancy by consolidating the Core Guidelines, Anti-Pattern Detection table, Common AI Mistakes, and Review Checklist into a single authoritative section — currently the same 10 patterns are stated 3-4 times each, consuming hundreds of tokens.

Move the Agent Behavioral Rules, Scope Boundaries, Tone Rules, and Output Format Rules into a separate file (e.g., `agent-behavior.md`) to keep SKILL.md focused on the actionable security content.

Add at least one complete, executable code example for the most common operation (e.g., the add-or-update keychain pattern with full OSStatus handling) directly in SKILL.md rather than deferring all code to reference files.

Provide the referenced bundle files (especially `keychain-fundamentals.md`, `common-anti-patterns.md`, and `credential-storage-patterns.md`) so the progressive disclosure structure actually functions — without them, the skill is a routing document to nowhere.

DimensionReasoningScore

Conciseness

The skill is extremely verbose at ~600+ lines. It extensively explains concepts Claude already knows (what UserDefaults is, what OSStatus means, how biometric bypass works), repeats the same anti-patterns across multiple sections (Core Guidelines, Common AI Mistakes, Anti-Pattern Detection table, Top-Level Review Checklist all cover the same ground), and includes lengthy scope boundary tables and behavioral rules that could be dramatically condensed. The philosophy preamble, tone rules, and agent behavioral boundaries add significant token overhead.

1 / 3

Actionability

The skill provides concrete guidance through its decision tree, checklists, and reference tables, but contains zero executable code examples — all actual code patterns are deferred to external reference files. The anti-pattern detection table gives specific search patterns which is actionable, but the core guidelines describe what to do without showing how (e.g., 'use an exhaustive switch' but no code). The skill is more of a routing/decision document than an executable reference.

2 / 3

Workflow Clarity

The three-branch decision tree (Review/Improve/Implement) provides clear sequencing with explicit steps. The Review branch has a numbered procedure with validation (run checklist → cross-check anti-patterns → check compliance → report format). The Improve branch includes pre-migration validation, atomic migration, secure deletion, and post-migration verification. The Implement branch ends with testing verification. Each branch has clear entry criteria and completion criteria.

3 / 3

Progressive Disclosure

The skill references 14 external files with a well-organized References Index and Domain Selection Guide, which is excellent structure. However, no bundle files are provided, so all those references are unresolvable. Additionally, the SKILL.md itself is monolithic — the Agent Behavioral Rules, Scope Boundaries, Tone Rules, and Common AI Mistakes sections are very long and could themselves be split into separate files. The inline content that should be in reference files (full anti-pattern table, accessibility constants table, CryptoKit algorithm table) bloats the main file.

2 / 3

Total

8

/

12

Passed

Description

82%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description excels at trigger term coverage and specificity, providing an exhaustive list of Apple security technologies and frameworks that would reliably match developer queries. However, it lacks a clear statement of what the skill actually does — it only says when to use it, not what actions or guidance it provides. Adding a brief capability statement would make it complete.

Suggestions

Add a 'what it does' statement before the trigger list, e.g., 'Guides implementation of security features on Apple platforms, including secure storage, authentication, and cryptographic operations.'

Consider briefly grouping the trigger terms into categories (e.g., 'keychain management', 'biometric auth', 'cryptography') to improve readability while retaining the specific terms.

DimensionReasoningScore

Specificity

The description lists numerous specific concrete actions and technologies: SecItem queries, kSecClass, OSStatus errors, LAContext, Face ID, Touch ID, CryptoKit algorithms (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, credential storage, certificate pinning, keychain sharing, migrating secrets, and OWASP compliance.

3 / 3

Completeness

The description starts with 'Use when...' which explicitly addresses the 'when' dimension, but the 'what does this do' part is missing — it never states what the skill actually does (e.g., 'Guides implementation of...', 'Provides best practices for...'). It only lists trigger scenarios without describing the skill's capabilities or actions.

2 / 3

Trigger Term Quality

Excellent coverage of natural trigger terms a developer would use: 'Keychain', 'Face ID', 'Touch ID', 'CryptoKit', 'Secure Enclave', 'OAuth tokens', 'API keys', 'certificate pinning', 'UserDefaults', 'OWASP MASVS'. These are exactly the terms iOS/macOS developers would mention when seeking help with security topics.

3 / 3

Distinctiveness Conflict Risk

The description is highly specific to Apple platform security — Keychain Services, LAContext, CryptoKit, SecTrust, OWASP MASVS/MASTG — creating a very clear niche that is unlikely to conflict with general iOS development skills, general cryptography skills, or Android security skills.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation11 / 11 Passed

Validation for skill structure

No warnings or errors.

Repository
ivan-magda/swift-security-skill
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.