Mobile secure storage

Skill ahtishamshahzad/agent_dev_flow/.ai/skills/mobile/mobile-secure-storage

Use to plan secure on-device storage — Keychain/Keystore for tokens and sensitive data vs async storage for non-sensitive data — with clear rules on what may be persisted where. No secrets in plain storage or logs.From its SKILL.md

Install

npx -y skills add ahtishamshahzad/agent_dev_flow --skill mobile-secure-storage

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

25 days oldThe repository was created 25 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.0 KB, 597 tokens by cl100k_base, as published. Nobody here has run it

Mobile Secure Storage

Purpose

Plan on-device storage: which data goes in secure storage (Keychain/Keystore) vs plain async storage, and the rules that keep sensitive data protected.

When to Use

When the app persists tokens, credentials, or any sensitive data.
Not for purely in-memory/ephemeral state.

Inputs

The data to persist and its sensitivity.
Runtime secure-storage options (Expo SecureStore / Keychain / Keystore).

Discovery Questions

Which values are sensitive (tokens, PII) vs non-sensitive (prefs)?
Which secure-storage API fits the runtime?
What is the rehydration and clear-on-logout behavior?

Responsibilities

Classify data sensitive vs non-sensitive.
Store sensitive data in Keychain/Keystore (secure storage); non-sensitive in async storage.
Define rehydration and clear-on-logout behavior.
Ensure sensitive data never lands in logs or plain storage (../../security-review).

Required Workflow

Classify each persisted value.
Route sensitive to secure storage, else async storage.
Define rehydration + logout-clear.
Confirm nothing sensitive is logged.
Record the storage plan.

Decision Rules

Tokens/credentials/PII to secure storage only.
Non-sensitive prefs to async storage is fine.
Clear sensitive storage on logout; never log sensitive values.

Rules

No secrets/tokens in plain async storage or logs.
Use platform secure storage for sensitive data.
Coordinate with auth for token handling.

Anti-Patterns

Tokens/PII in plain async storage.
Sensitive values in logs.
No clear-on-logout.
Encrypting nothing and calling it secure.

Validation Checklist

Data classified by sensitivity.
Sensitive to secure storage; non-sensitive to async storage.
Rehydration + logout-clear defined.
No sensitive data logged.

Definition of Done

A recorded storage plan: sensitive data in Keychain/Keystore, non-sensitive in async storage, defined rehydration and clear-on-logout, and no sensitive values in logs.

Related Skills

mobile-authentication, mobile-state-management, ../../security-review, mobile-environment-config

Related Knowledge

../../../knowledge/ (data sensitivity).

Related References

../../../references/mobile/native/ when populated.

Context Loading Guidance

Requires: data to persist + sensitivity, runtime secure-storage options.
Does not require: unrelated screens, the full mobile skill set, unrelated references.
May load: mobile-authentication for tokens; ../../security-review for exposure.
Stop when: the storage plan is recorded.

Token Efficiency Guidance

Plan from the persisted-value list and sensitivity; keep it short.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.