swift-security-skill AGENTS.md

swift-security-skill AGENTS.md is an instructions file for Codex, OpenCode from ivan-magda/swift-security-skill. It costs 844 tokens per session, scanned A, original, MIT.

Repository instructions for an iOS and macOS security skill covering Keychain, biometrics, cryptography, credentials, certificates, and OWASP guidance.

In plain words
What is it for?
Onboarding agents to the project and guiding work on Apple-platform security features.
Why use it?
They help an agent understand the repository structure, contribution rules, and testing expectations before changing the code.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/ivan-magda/swift-security-skill/agents-md
Clone the repo
git clone --depth 1 https://github.com/ivan-magda/swift-security-skill

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for swift-security-skill AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/ivan-magda/swift-security-skill/agents-md.svg)](https://agentmods.dev/instructions/ivan-magda/swift-security-skill/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/ivan-magda/swift-security-skill/agents-md"><img src="https://agentmods.dev/badge/instructions/ivan-magda/swift-security-skill/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 844 This file is loaded in full into every session.
When invoked 844 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00844 $0.00844
Opus 5 $0.00422 $0.00422
Sonnet 5 $0.00169 $0.00169
Haiku 4.5 $0.00084 $0.00084

Measured 4d ago against content hash cc7bb3698616, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

swift-security-skill AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 65 lines

How it starts

The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

This repository contains the Keychain & Security Expert Skill — a non-opinionated, correctness-focused reference for iOS/macOS keychain operations, biometric authentication, CryptoKit cryptography, credential lifecycle management, certificate trust, and OWASP compliance mapping.

Repo Structure

AGENTS.md                              ← you are here (repo-level agent onboarding)
CLAUDE.md -> AGENTS.md                ← symlink for Claude Code compatibility
README.md                              ← human-facing documentation
LICENSE
.claude-plugin/
  plugin.json                          ← Claude Code plugin manifest
  marketplace.json                     ← Claude Code marketplace catalog
swift-security-expert/
  SKILL.md                             ← the skill: router, guidelines, behavioral rules
  references/
    keychain-fundamentals.md           ← SecItem* CRUD, query dictionaries, OSStatus
    keychain-item-classes.md           ← kSecClass types, composite primary keys
    keychain-access-control.md         ← accessibility constants, SecAccessControl
    biometric-authentication.md        ← keychain-bound biometrics, LAContext bypass
    secure-enclave.md                  ← hardware-backed P256, simulator traps
    cryptokit-symmetric.md             ← SHA-2/3, HMAC, AES-GCM, ChaChaPoly, HKDF
    cryptokit-public-key.md            ← ECDSA, ECDH, HPKE, ML-KEM/ML-DSA
    credential-storage-patterns.md     ← OAuth tokens, API keys, refresh rotation
    keychain-sharing.md                ← access groups, Team ID, extensions
    certificate-trust.md               ← SecTrust, SPKI pinning, mTLS
    migration-legacy-stores.md         ← UserDefaults/plist → Keychain migration
    common-anti-patterns.md            ← top 10 AI-generated security mistakes
    testing-security-code.md           ← protocol mocks, CI/CD, Swift Testing
    compliance-owasp-mapping.md        ← OWASP Mobile Top 10, MASVS, MASTG

How to Use This Skill

  1. Start with SKILL.md — it contains the decision tree router (review / improve / implement), core guidelines, quick reference tables, behavioral rules, and the references index.
  2. Load reference files on demandSKILL.md tells you which files to load for each query type. Do not load all 14 at once.
  3. Follow the behavioral rules in SKILL.md — tone calibration, output format, common AI mistakes watchlist, and scope boundaries are all defined there.

Read the full file on GitHub · 65 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 65 lines · 844 tokens per session scan A cc7bb3698616

Subscribe to this mod's changes

swift-security-skill AGENTS.md is an instructions file published in the GitHub repository ivan-magda/swift-security-skill (31 stars, last pushed 2mo ago), licensed MIT. It adds 844 tokens to every session, about $0.0042 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories

ios-agent-skill AGENTS.md

Instructions for Nagarjuna2997/ios-agent-skill, covering ios agent skill — claude ai expert ios/swift developer, when to load this skill, loading the right document, how these docs are structured and how you operate: delegation, loops, and verification.

Nagarjuna2997/ios-agent-skill · 15,145 tokens

ios-agent-skill CLAUDE.md

Instructions for Nagarjuna2997/ios-agent-skill, covering ios agent skill — claude ai expert ios/swift developer, when to load this skill, loading the right document, how these docs are structured and how you operate: delegation, loops, and verification.

Nagarjuna2997/ios-agent-skill · 15,145 tokens

ios-agent-skill GEMINI.md

Instructions for Nagarjuna2997/ios-agent-skill, covering ios agent skill — claude ai expert ios/swift developer, when to load this skill, loading the right document, how these docs are structured and how you operate: delegation, loops, and verification.

Nagarjuna2997/ios-agent-skill · 15,145 tokens

mcp-steroid CLAUDE.md

Claude Code instructions for jonnyzzz/mcp-steroid, covering claude.md, agents.md, design philosophy, recursive context lookup (do this before sub-folder work), sub-folder guides and must do.

jonnyzzz/mcp-steroid · 6,916 tokens

skills CLAUDE.md

Instructions for mixedbread-ai/skills, covering mixedbread skills, repository structure, conventions, adding a new skill and testing a skill.

mixedbread-ai/skills · 1,225 tokens

growmos AGENTS.md

Instructions for codician-team/growmos: This repository keeps a knowledge graph in .growmos/ (entities, typed relations, provenance, profiles, a journal). It is the shared world model that survives context windows. Treat it as memory you read at the start of work and write to as you develop. Zero-config commands.

codician-team/growmos · 606 tokens