Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only macOS SwiftUI guidance skill with no hidden execution, credential access, or persistence behavior found.
Before installing, understand that this skill may be invoked across many macOS SwiftUI tasks and gives strong, opinionated guidance for modern macOS 26 and Swift 6.2 projects. Review any generated project changes as usual, especially dependency additions or persistence-related app code, but the skill package itself is documentation-only and showed no hidden runtime behavior.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## @AppStorage
- Only works inside `View` structs. Does NOT trigger updates inside `@Observable` classes, even with `@ObservationIgnored`.
- Never store sensitive data (passwords, tokens) — use Keychain.
## Identifiable
The skill advertises itself for essentially any macOS SwiftUI project work, including building, reviewing, debugging, architecture, and design decisions. That broad trigger can cause over-invocation outside a narrowly scoped need, increasing the chance the agent applies filesystem-backed references and strong prescriptive guidance in situations where a more specialized or safer skill should be used.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Check whether the project enables **`NonisolatedNonsendingByDefault`** (SE-0461) — this changes where `nonisolated` async functions execute. See `references/concurrency.md`.
- Prefer SwiftUI-native solutions. Use AppKit (`NSViewRepresentable`, `NSHostingView`, `NSWindow`) only when SwiftUI has no equivalent.
- **Understand the mechanism.** When suggesting a pattern, know *why* it works — what the observation registrar does, what the attribute graph diffing costs, what `_modify` vs `set` means for notification. Rules without understanding produce cargo-culted code.
- Do not introduce third-party frameworks without asking. Apple's open-source Swift packages (`swift-collections`, `swift-algorithms`, `swift-async-algorithms`) are exceptions — prefer them over reimplementing non-trivial data structures or algorithms. See `references/api.md`.
## Examples
Line L167 uses prescriptive natural language that implies a universal interaction requirement: right-click menus are expected on virtually every interactive element. This is overly absolute guidance rather than a clearly justified platform-specific recommendation, and could push implementations toward unnecessary UI behavior without documenting exceptions or context.
No suspicious patterns detected.