agentsclimarketplace

Kmp security privacy

Skill Xopoko/plug-n-skills/plugins/kotlin-multiplatform/skills/kmp-security-privacy

Ready-to-install skills and plugins for Codex, Claude Code, and AI coding agents: practical workflows for app delivery, architecture, research, design, and agent tooling.

Install
npx -y skills add Xopoko/plug-n-skills --skill kmp-security-privacy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review Kotlin Multiplatform security and privacy across secure storage, tokens, Ktor auth, TLS, certificate pinning, logging redaction, runtime protection, platform APIs, and commonMain boundaries.

SKILL.md

1.8 KB, 325 tokens by cl100k_base, as published. Nobody here has run it

KMP Security And Privacy

Use for KMP secrets, tokens, authentication, secure storage, logging redaction, network security, privacy-sensitive data, runtime app protection, and platform security boundaries.

Review Flow

  1. Search shared code, tests, configs, and logs for secret-like names and literals.
  2. Find where tokens, refresh tokens, device identifiers, PII, and encryption keys live.
  3. Confirm common code exposes interfaces and policies while platform source sets own storage implementation.
  4. Review Ktor auth, refresh-token loops, retries, TLS/certificate pinning, and redaction.
  5. Check CI/release examples do not contain signing, keystore, App Store, Maven Central, or token material.

Rules

  • commonMain should not hardcode secrets or own platform storage implementation.
  • Android sensitive key-value storage should use Android-backed secure storage.
  • iOS sensitive key-value storage should use Keychain-backed storage.
  • Shared logging APIs must redact tokens, auth headers, refresh responses, PII, and request bodies unless explicitly safe.
  • Refresh-token requests must avoid recursive auth interception.
  • Certificate pinning and runtime app protection are risk-based choices; do not add them as universal defaults.
  • Hardware-backed encrypted storage libraries and runtime app protection SDKs are optional. Verify threat model, target support, maintenance, incident response, and policy before adoption.

Output

Lead with:

  • security verdict
  • exact files and flows reviewed
  • hard blockers
  • platform-boundary issues
  • redaction gaps
  • network/auth risks
  • tests or manual checks needed

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Keep looking

Skills are one crate of 327,132. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.