{
  "skill_name": "swift-security",
  "evals": [
    {
      "id": 0,
      "name": "keychain-token-review",
      "prompt": "Review this helper from our fitness app. `SessionVault.save(refresh:)` keeps a fallback copy via `UserDefaults.standard.set(token, forKey: \"rt\")`, then calls `SecItemDelete` on the same service and account followed by `SecItemAdd` with class, service, account and value data. The return value of `SecItemAdd` is ignored and no accessibility attribute is passed. Tell us what is wrong and how to fix it.",
      "expected_output": "Flags the UserDefaults copy of the refresh token as CRITICAL or HIGH and says it must be removed. Points out the ignored OSStatus and shows handling for errSecDuplicateItem, errSecItemNotFound and errSecInteractionNotAllowed. Adds an explicit kSecAttrAccessible value (or a SecAccessControl) to the add dictionary. Replaces delete-then-add with add, then SecItemUpdate when the add reports a duplicate. Shows wrong and corrected code and names the reference files used.",
      "files": [],
      "expectations": [
        "Rates the refresh token stored in UserDefaults as critical or high severity",
        "Adds OSStatus checks that cover errSecDuplicateItem, errSecItemNotFound and errSecInteractionNotAllowed",
        "Sets kSecAttrAccessible explicitly, or uses a SecAccessControl, on the add",
        "Rejects the delete-then-add save and calls SecItemUpdate when SecItemAdd returns a duplicate",
        "Cites the reference files that support the fixes"
      ]
    },
    {
      "id": 1,
      "name": "biometric-secret-boundary",
      "prompt": "Our banking app shows the full card number after `LAContext().evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason:)` returns true. The number itself lives in UserDefaults and Info.plist has no Face ID entry. Is this acceptable, and what should we change?",
      "expected_output": "Says a Bool from evaluatePolicy is not a security boundary and can be forced true at runtime. Moves the card number into the keychain, guarded by a SecAccessControl using .biometryCurrentSet (or .userPresence where passcode fallback is wanted) so the read itself triggers the prompt. Adds NSFaceIDUsageDescription to Info.plist. Explains that .biometryCurrentSet makes the item unreadable after an enrollment change, how evaluatedPolicyDomainState detects that, and the recovery path. Cites biometric-authentication.md and keychain-access-control.md.",
      "files": [],
      "expectations": [
        "Rejects the evaluatePolicy Bool as the only gate",
        "Stores the secret in the keychain behind SecAccessControl using .biometryCurrentSet or .userPresence",
        "Mentions adding NSFaceIDUsageDescription to Info.plist",
        "Says what an enrollment change does to a .biometryCurrentSet item, covers detection through evaluatedPolicyDomainState, and a recovery flow",
        "Cites biometric-authentication.md and keychain-access-control.md"
      ]
    },
    {
      "id": 2,
      "name": "security-sibling-boundary",
      "prompt": "Give us a security checklist for our next release. It covers: refresh-token storage in the keychain, the access policy for a Secure Enclave signing key, pinning our API certificate, end-to-end encrypting chat messages with CryptoKit, adding Sign in with Apple and passkeys, verifying OAuth tokens on the relying party, App Attest, URLSession TLS settings, and our privacy manifest. We also want to try ML-KEM.",
      "expected_output": "Treats four items as in scope here: keychain refresh-token storage, the access policy of the enclave key, certificate trust, and CryptoKit encryption on the client. Hands passkeys, Sign in with Apple, OAuth and relying-party verification to authentication, App Attest and DeviceCheck to device-integrity, URLSession and TLS configuration to ios-networking (the custom CryptoKit end-to-end layer stays here), and the privacy manifest to app-store-review. Notes that X-Wing, ML-DSA, ML-KEM, SHA-3 and the Secure Enclave post-quantum types need iOS 26.",
      "files": [],
      "expectations": [
        "Treats keychain token storage, the enclave key policy, certificate trust and client-side CryptoKit as in scope",
        "Routes passkeys, Sign in with Apple, OAuth and relying-party verification to authentication",
        "Routes App Attest and DeviceCheck to device-integrity",
        "Sends URLSession and TLS settings to ios-networking and keeps the app's own end-to-end CryptoKit layer here",
        "Routes privacy manifests to app-store-review",
        "Says X-Wing, ML-DSA, ML-KEM, SHA-3 and the enclave post-quantum APIs require iOS 26"
      ]
    }
  ]
}