Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add softspark/ai-toolkit --skill swift-rulesgit clone --depth 1 https://github.com/softspark/ai-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/softspark/ai-toolkit/swift-rules)<a href="https://agentmods.dev/skills/softspark/ai-toolkit/swift-rules"><img src="https://agentmods.dev/badge/skills/softspark/ai-toolkit/swift-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/softspark/ai-toolkit/swift-rules"><img src="https://agentmods.dev/badge/skills/softspark/ai-toolkit/swift-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 216 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 185 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 187 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 189 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Rogue Agent · line 188 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.03219 |
| Opus 5 | $0.00020 | $0.01610 |
| Sonnet 5 | $0.00008 | $0.00644 |
| Haiku 4.5 | $0.00004 | $0.00322 |
Grade A, and why
swift-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 294 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Swift Rules
These rules come from app/rules/swift/ in ai-toolkit. They cover
the project's standards for coding style, frameworks, patterns,
security, and testing in Swift. Apply them when writing or
reviewing Swift code.
Swift Coding Style
Naming
- PascalCase: types, protocols, enums, struct, class.
- camelCase: functions, methods, properties, variables, enum cases.
- No prefixes: Swift has module namespacing (no
NSorUIprefix for your types). - Use descriptive names:
removeElement(at:)notremove(i:). - Boolean properties read as assertions:
isEmpty,hasChildren,canSubmit.
Types
- Prefer
structoverclassby default (value semantics, no reference cycles). - Use
classonly when reference semantics or inheritance is required. - Use
enumwith associated values for modeling finite states. - Use
protocolfor defining capabilities. Prefer protocol composition. - Use
typealiasfor complex generic signatures for readability.
Optionals
- Use
guard letfor early exit on nil. Useif letfor conditional binding. - Never force-unwrap (
!) unless failure is a programming error. - Use
??for default values:let name = user?.name ?? "Unknown". - Use optional chaining:
user?.address?.city. - Use
map/flatMapon optionals for transformations.
Properties
- Use
letby default. Usevaronly when mutation is required. - Use computed properties for derived values:
var fullName: String { ... }. - Use property observers (
willSet,didSet) for side effects on change. - Use
lazy varfor expensive initialization deferred until first access. - Use
@Published(Combine) for observable properties in classes.
Functions
- Use argument labels for clarity:
func move(from source: Int, to destination: Int). - Omit argument labels when the function name makes the role clear:
func contains(_ element: T). - Use default parameter values instead of multiple overloads.
- Use
throws/async throwsfor fallible operations. - Use trailing closure syntax for the last closure parameter.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 294 lines · 41 tokens per session scan A 0d21dd42cd04
swift-rules is a skill published in the GitHub repository softspark/ai-toolkit (174 stars, last pushed yesterday), licensed Apache-2.0. It adds 41 tokens to every session and 3,219 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
android-kotlin-advisor
Développement Android natif avec Kotlin et Jetpack Compose — architecture MVVM/MVI, UI Compose, Hilt, Room, Coroutines, Flow, tests, Gradle KTS, Play Store. Se déclenche avec "Android", "Kotlin", "Jetpack Compose", "Android Studio", "Gradle", "Room", "Hilt", "Coroutines", "Play Store". Also triggers on "Android with…
agent-flutter-expert
Expert Flutter specialist mastering Flutter 3+ with modern architecture patterns. Specializes in cross-platform development, custom animations, native integrations, and performance optimization with focus on creating beautiful, native-performance applications.
swift-development
You MUST activate this skill when working on Swift projects.
generators
Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings, persistence, error monitoring, CI/CD pipelines, localization, push notifications, deep linking, testing…
android-development
Android development with Kotlin, Jetpack Compose, and modern Android architecture. Use when building Android apps, implementing Material Design, or following Android best practices.
ios-development
Comprehensive guide for building native Apple platform applications.