Axiom Security

Security & Credentials

You MUST use this skill for ANY keychain, encryption, passkey, app integrity, agentic/AI feature security, file protection, or code signing work.

<!-- AXIOM_AUDITOR_INLINE_BEGIN — auto-maintained by scripts/build-inlined-auditors.ts; do not hand-edit -->

Not on Claude Code? Where this router says "Launch some-auditor agent", read that auditor's file in this suite and follow it inline — the same procedure, needing only file search and read. Available here: skills/security-privacy-scanner.md. Agents that need Bash — builds, tests, simulators, crash symbolication — stay Claude Code-only; there is no inline equivalent for those.

<!-- AXIOM_AUDITOR_INLINE_END -->

Quick Reference

Decision Tree

digraph security {
    start [label="Security task" shape=ellipse];
    what [label="What do you need?" shape=diamond];

    start -> what;
    what -> "skills/keychain.md" [label="store/retrieve\ncredentials, tokens,\nsecrets"];
    what -> "skills/keychain-ref.md" [label="SecItem API syntax,\nattribute constants,\naccess levels"];
    what -> "skills/keychain-diag.md" [label="keychain errors\n(errSec codes)"];
    what -> "skills/cryptokit.md" [label="encrypt data,\nsign payloads,\nSecure Enclave keys"];
    what -> "skills/cryptokit-ref.md" [label="CryptoKit API\n(AES, ECDSA, HPKE,\npost-quantum)"];
    what -> "skills/passkeys.md" [label="passkey sign-in,\nreplace passwords"];
    what -> "skills/app-attest.md" [label="app integrity,\nfraud prevention"];
    what -> "skills/agentic-security.md" [label="AI agent security,\nprompt injection"];
    what -> "skills/file-protection-ref.md" [label="file encryption,\nNSFileProtection"];
    what -> "skills/code-signing.md" [label="set up signing,\nprofiles, CI/CD"];
    what -> "skills/code-signing-diag.md" [label="signing errors,\nupload rejections"];
    what -> "skills/code-signing-ref.md" [label="CLI commands,\nprofile inspection"];
}

1. Store tokens, passwords, API keys securely? → skills/keychain.md

1a. Need SecItem function signatures, attribute constants? → skills/keychain-ref.md 1b. Keychain errors (errSecDuplicateItem, errSecItemNotFound)? → skills/keychain-diag.md

1. Encrypt data, sign payloads, manage keys? → skills/cryptokit.md

2a. Need CryptoKit API details (AES-GCM, ECDSA, HPKE, post-quantum)? → skills/cryptokit-ref.md

1. Implement passkey sign-in, replace passwords? → skills/passkeys.md
2. Verify app integrity, prevent fraud? → skills/app-attest.md
3. Securing an agentic/AI feature (prompt injection, tool confirmation, lock-screen intents)? → skills/agentic-security.md
4. File encryption at rest, NSFileProtection levels? → skills/file-protection-ref.md
5. Set up code signing, manage certificates, CI/CD? → skills/code-signing.md

7a. Code signing error troubleshooting? → skills/code-signing-diag.md 7b. Certificate CLI commands, profile inspection? → skills/code-signing-ref.md

1. Build/upload failures after signing? → See axiom-build
2. App Store submission prep? → /skill axiom-shipping
3. Privacy manifests, tracking transparency? → See axiom-integration
4. Data persistence (SwiftData, Core Data, storage strategy)? → /skill axiom-data
5. TLS configuration, certificate pinning for network requests? → /skill axiom-networking
6. Want automated security scan? → security-privacy-scanner (Agent)

Conflict Resolution

security vs axiom-build: When build fails with signing errors:

• Code signing errors (certificate, profile, entitlement) → use security
• Environment issues (Xcode version, simulator, Derived Data) → use axiom-build
• If unsure, check the error message: CODESIGN, ITMS-90xxx, errSec → security

security vs shipping: When preparing for App Store:

• Privacy manifests, submission checklists, rejections → use shipping
• Code signing for distribution, certificate management → use security

security vs axiom-data: When storing sensitive data:

• Tokens, passwords, API keys → use security (keychain)
• User preferences, non-sensitive settings → use axiom-data (UserDefaults/SwiftData)
• File encryption levels for database files → use security (file-protection-ref)
• SQLite-specific Data Protection (.db/-wal/-shm trio, widget-while-locked access) → See axiom-data (skills/grdb-app-groups.md) §4

security vs axiom-networking: When securing network communication:

• TLS configuration, certificate pinning → use axiom-networking
• Signing API requests, encrypting payloads → use security (CryptoKit)

Critical Patterns

Keychain (skills/keychain.md):

• SecItem mental model: uniqueness constraints, data protection classes
• Biometric access control (Face ID / Touch ID)
• Keychain sharing between app and extensions
• Background access pitfalls, Mac keychain differences
• Migration from UserDefaults/@AppStorage for sensitive data

Keychain API (skills/keychain-ref.md):

• SecItemAdd/CopyMatching/Update/Delete signatures
• Item class attributes, uniqueness constraint rules
• kSecAttrAccessible levels and when each applies
• Access control flags, biometric integration
• Complete error code reference

Keychain Diagnostics (skills/keychain-diag.md):

• errSecDuplicateItem from unexpected uniqueness constraints
• errSecItemNotFound despite item existing (query mismatch)
• errSecInteractionNotAllowed in background contexts
• Access group and entitlement mismatches
• Items disappearing after app updates

CryptoKit (skills/cryptokit.md):

• AES-GCM and ChaChaPoly authenticated encryption
• ECDSA/EdDSA digital signatures
• Secure Enclave hardware-backed keys
• Key agreement (ECDH) for end-to-end encryption
• HPKE for modern asymmetric encryption
• Post-quantum algorithms (ML-KEM, ML-DSA)
• CommonCrypto migration path

CryptoKit API (skills/cryptokit-ref.md):

• Hash functions (SHA-256/384/512, SHA-3), HMAC
• Symmetric encryption (AES-GCM, ChaChaPoly)
• Asymmetric signing (P256, P384, P521, Curve25519, Ed25519)
• Key agreement, key derivation (HKDF)
• Secure Enclave key creation and usage
• Swift Crypto cross-platform parity

Passkeys (skills/passkeys.md):

• ASAuthorizationController registration and assertion flows
• AutoFill-assisted requests (QuickType bar integration)