{
  "skill_name": "authentication",
  "evals": [
    {
      "id": 0,
      "name": "passkey-enrollment-and-login",
      "prompt": "Our recipe app wants passwordless accounts on iOS 26. Show how to add passkey enrollment and passkey login, including suggestions in the username field, and mention hardware keys for staff accounts.",
      "expected_output": "Configures Associated Domains with a webcredentials entry and association file, uses ASAuthorizationPlatformPublicKeyCredentialProvider with separate registration and assertion requests built from server challenges, sends results to the server for verification before creating a session, sets textContentType .username and calls performAutoFillAssistedRequests, and uses the security-key provider only as a separate path for physical keys.",
      "files": [],
      "expectations": [
        "Requires a webcredentials entry under Associated Domains",
        "Uses the platform provider with distinct registration and assertion requests",
        "Takes challenges from the server and verifies results server-side before issuing a session",
        "Uses performAutoFillAssistedRequests with a .username field for inline suggestions",
        "Treats the security-key provider as a separate branch for physical keys only"
      ]
    },
    {
      "id": 1,
      "name": "apple-and-github-login-review",
      "prompt": "Review our login code: Sign in with Apple reads credential.email! on every sign-in, we never check whether the Apple ID is still linked, the identity token is decoded in the app to get the user, GitHub login runs inside a WKWebView, the session token is in UserDefaults, and Face ID success unlocks the stored token.",
      "expected_output": "Flags the missing capability or presentation provider if absent, caches email and name only on first authorization without force unwraps, adds getCredentialState at launch plus credentialRevokedNotification, moves identity token and authorization code validation to the server, switches GitHub to ASWebAuthenticationSession with a real presentation anchor, stores tokens in the Keychain, and treats LAContext as local re-authentication rather than a secret release.",
      "files": [],
      "expectations": [
        "Notes that email and fullName arrive only on the first authorization and must be cached then",
        "Adds getCredentialState at launch and observes credentialRevokedNotification",
        "Validates the identity token and authorization code on the server",
        "Replaces WKWebView with ASWebAuthenticationSession and a real presentation anchor",
        "Moves tokens to the Keychain",
        "States that LAContext success alone must not release stored secrets"
      ]
    },
    {
      "id": 2,
      "name": "auth-scope-routing",
      "prompt": "While adding Sign in with Apple, can you also design our Keychain migration, pick SecAccessControl flags, add certificate pinning, and map us against OWASP MASVS? Also write our WebAuthn relying-party server.",
      "expected_output": "Keeps the sign-in flow in scope, routes Keychain migration, access-control policy, CryptoKit, Secure Enclave, pinning and MASVS to the swift-security skill, restates the minimum rule that tokens go in the Keychain and evaluatePolicy does not release secrets, and does not claim to own the backend WebAuthn relying-party implementation beyond server challenges and verification.",
      "files": [],
      "expectations": [
        "Implements or discusses the Sign in with Apple flow itself",
        "Routes Keychain architecture, access-control flags, pinning and MASVS to swift-security",
        "Keeps the rule that tokens belong in the Keychain",
        "Says evaluatePolicy alone does not release protected secrets",
        "Does not present itself as the owner of a backend WebAuthn relying-party implementation"
      ]
    }
  ]
}