What is capacitor-ios-security-hardening?

A security-audit and hardening guide for the build settings and native code of a Capacitor iOS app, including Swift, Objective-C, and C.

It is for reviewing Xcode build settings, enabling security warnings, running the Xcode static analyzer, and checking native plugins and package configuration.

It helps find unsafe compiler settings, static-analysis findings, and other build or code issues that can weaken an iOS app's security.

capacitor-ios-security-hardening — Skill for Claude Code by Cap-go

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Cap-go/capgo-skills --skill capacitor-ios-security-hardening

Clone the repo

git clone --depth 1 https://github.com/Cap-go/capgo-skills

Made for: Claude Code.

Or install capacitor-quality, the plugin that ships this one along with the rest of its 7 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/cap-go/capgo-skills/capacitor-ios-security-hardening/github.svg)](https://agentmods.dev/skills/cap-go/capgo-skills/capacitor-ios-security-hardening)

Your own site

<a href="https://agentmods.dev/skills/cap-go/capgo-skills/capacitor-ios-security-hardening"><img src="https://agentmods.dev/badge/skills/cap-go/capgo-skills/capacitor-ios-security-hardening/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/cap-go/capgo-skills/capacitor-ios-security-hardening"><img src="https://agentmods.dev/badge/skills/cap-go/capgo-skills/capacitor-ios-security-hardening.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 217 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,039 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00217	$0.03039
Opus 5.5	$0.00087	$0.01216
Sonnet 5.5	$0.00043	$0.00608
Haiku 4.5	$0.00022	$0.00304

Measured 6d ago against content hash 3569291b1ee1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

capacitor-ios-security-hardening scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/audit-build-settings.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/capacitor-quality/skills/capacitor-ios-security-hardening/SKILL.md · 143 lines

How it starts

The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Capacitor iOS Security Hardening

Audit the security-relevant Xcode build settings of a Capacitor app and its native plugins, then enable them in stages the user approves. This skill changes build settings and entitlements only. It never touches web code, ATS, signing, or secrets.

When to Use

TRIGGER when:

The user wants to audit or harden the iOS build configuration of a Capacitor app
The user asks about Enhanced Security, ENABLE_ENHANCED_SECURITY, hardened-process entitlements, pointer authentication, arm64e, or memory tagging
After enabling Enhanced Security, the link step fails with errors that mention arm64e
A plugin author wants stricter warnings or static analysis for plugin Swift/ObjC/C code
The user wants "Build and Analyze" / xcodebuild analyze in CI

Do not use:

ATS, TLS pinning, signing, secrets, WebView config, Capsec scans: capacitor-security
App Store privacy manifest and review checklist: capacitor-apple-review-preflight
The AppDelegate to SceneDelegate migration: capacitor-uiscene-migration
Android R8, network security config: capacitor-security

Facts that change the plan

Build settings do not cross project boundaries. Settings on the App target do not apply to Pods (ios/App/Pods/Pods.xcodeproj), to SPM packages (plugins, CapApp-SPM), or to the Cordova plugin package that npx cap sync generates. Hardening plugin code is done in the plugin repo (podspec / Package.swift), not in the app.
The App target of a stock Capacitor app is pure Swift (AppDelegate.swift, SceneDelegate.swift). Clang warnings and analyzer checkers only matter if the app target has .m, .mm, .c or .cpp files. Detect languages before proposing them.
The Capacitor 8 templates already set three Stage A warnings at project level (GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR, GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE, GCC_WARN_64_TO_32_BIT_CONVERSION = YES). Report them as already hardened. Do not re-add them.
WKWebView content is not affected. JavaScript and JIT run in WebKit's own processes. Enhanced Security entitlements apply to the app process and the native code linked into it (Capacitor runtime, plugins, SDKs).
Pointer authentication adds an arm64e slice to device builds. Every binary linked into the app must also have arm64e, or the link fails. This is the main breakage risk in Capacitor apps. See references/enhanced-security.md.
Do not edit generated files. ios/App/Pods/**, Pods-App.*.xcconfig, ios/App/CapApp-SPM/Package.swift, ios/capacitor-cordova-ios-plugins/** and ios/debug.xcconfig (SPM template, Debug only, CLI-managed) are rewritten by CocoaPods or npx cap sync. Put settings in the App project (Xcode Build Settings, which writes project.pbxproj) or in an xcconfig the team already owns.
The user owns the result. Enhanced Security turns latent memory bugs into crashes. Report findings and get approval before changing anything. Test on real hardware before shipping.

Read the full file on GitHub · 143 lines

Files

What ships with it

7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 143 lines · 217 tokens per session scan A 3569291b1ee1

Subscribe to this mod's changes

capacitor-ios-security-hardening is a skill published in the GitHub repository Cap-go/capgo-skills (73 stars, last pushed 2d ago), licensed MIT. It adds 217 tokens to every session and 3,039 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-11.

Mobile Security agents ai capacitor capacitor-skills capgo skills

loom-dart

Dart language expertise for idiomatic, production-quality code.

cosmix/loom · 16 tokens

deploy-edge-ai-model

Deploy machine learning models to edge devices using Google AI Edge Gallery, TensorFlow Lite, ONNX Runtime, and MediaPipe. Covers model quantization (INT8/INT4), on-device inference with Gemma 4 models, Android/iOS deployment via AI Edge Gallery, hardware delegate selection (GPU/NPU/DSP), and performance benchmarking…

pjt222/agent-almanac · 108 tokens

capacitor-plugins

Guides the agent through installing, configuring, and using Capacitor plugins from six sources — official Capacitor plugins, Capawesome plugins, Capacitor Community plugins, Capacitor Firebase plugins, Capacitor MLKit plugins, and RevenueCat plugins. Covers installation, platform-specific configuration (Android and…

capawesome-team/skills · 101 tokens

ionic-appflow-migration

Guides the agent through migrating an existing Ionic Appflow project to Capawesome Cloud. Imports an Ionic Appflow organization export with the Capawesome CLI apps:import command — apps, signing certificates, environments, live update channels, native configurations, store destinations, build automations, and…

capawesome-team/skills · 196 tokens

capacitor-expert

A comprehensive starting point for AI agents to work with Capacitor. Covers core concepts, CLI, app creation, plugins, framework integration, best practices, storage, security, testing, troubleshooting, upgrading, and Capawesome Cloud (live updates, native builds, app store publishing). Pair with the other Capacitor…

capawesome-team/skills · 76 tokens

capgo-cloud-migration

Guides the agent through migrating an existing Capacitor project from Capgo to Capawesome Cloud. Detects Capgo usage (the @capgo/capacitor-updater plugin, CapacitorUpdater configuration, and @capgo/cli commands in CI/CD) and provides step-by-step migration: replacing the plugin with @capawesome/capacitor-live-update…

capawesome-team/skills · 160 tokens