swift-security-expert
Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.
62
65%
Does it follow best practices?
Impact
100%
1.53xAverage score across 1 eval scenario
High
Do not use without reviewing
Fix and improve this skill with Tessl
tessl review fix ./swift-security-expert/SKILL.mdSecurity
1 high severity finding. You should review these findings carefully before considering using this skill.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I inspected the skill content and found one high-entropy API key literal present: the Stripe-style key sk_live_4eC39HqLyjWDarjtT1zdp7dc. It is a long, random-looking string (sk_live prefix + entropy) embedded as a literal in example code, so it meets the definition of a secret (high-entropy, usable credential) and should be treated as a leaked credential. The other potential matches (PRIVATE_KEY headers) do not appear as complete PEM private-key blocks in the provided skill text — only header-like fragments were flagged by the auto pre-filter. No full PEM content or private-key material is present, so those are treated as false positives (no usable key material). Therefore I flag the Stripe key as a secret and ignore the PRIVATE_KEY matches as non-actionable placeholders / incomplete fragments.
- Repository
- ivan-magda/swift-security-skill
- Commit
bda2e0c
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.