Ios sec
A collection of Claude Code skills for iOS, MERN, NEAN, and shared development workflows
npx -y skills add edfenton/claude-skills --skill ios-secAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Security policy for iOS apps. Enforces OWASP Top 10, Mobile Top 10, and CWE Top 25 mitigations.
SKILL.md
1.5 KB, as published. Nobody here has run it
Purpose
Ensure iOS code is secure by default. For security output format and core refusal policy, see /shared-sec-baseline.
iOS-specific security concerns (always check)
- Keychain for secrets — never UserDefaults for tokens, passwords, or API keys
- ATS enforcement — no exceptions without justification; never disable TLS validation
- Deep link validation — validate scheme, host, and parameters before acting on universal/custom links
- Notification payloads — treat as untrusted input; validate before navigation or data use
- Biometric auth — use LocalAuthentication with fallback policy; don't rely solely on device passcode
- Privacy manifest — declare data collection accurately; required APIs need justification
Standard security (brief check)
- Input validation: sanitize all external input (network, clipboard, deep links)
- Error handling: no internal details surfaced to UI or logs
- Logging: no PII, tokens, or credentials; use OSLog with appropriate privacy levels
- Network: certificate pinning for sensitive endpoints; handle certificate failures safely
Additional refusals (iOS-specific)
Also refuse requests that: disable ATS, or store secrets in UserDefaults. Explain why and propose secure alternative.
Reference
For detailed OWASP/Mobile Top 10/CWE mitigation patterns, see reference/ios-sec-reference.md