How do I install the Security skill?

Run npx skillmds@latest add caglarbaranbora/security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security?

caglarbaranbora (@caglarbaranbora) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security by caglarbaranbora — Agent Skill

Name: Security
Author: caglarbaranbora

Security

Route Keychain Services implementation tasks to the correct Knowledge Contracts -- item CRUD via SecItemAdd/SecItemCopyMatching/SecItemUpdate/SecItemDelete, accessibility levels, access groups and sharing, and storing structured/Codable data. Use when working with kSecClassGenericPassword, kSecClassInternetPassword, OSStatus, errSecSuccess, errSecItemNotFound, errSecDuplicateItem, kSecAttrAccessible, kSecAttrAccessGroup, Keychain Sharing, or kSecValueData. v1 is general (non-biometric-bound) Keychain item CRUD for generic/internet password items -- no SecAccessControl/biometric binding, no AutoFill/credential providers, no iCloud Keychain sync, no certificate/key/identity item classes. Triggers on SecItemAdd, SecItemCopyMatching, SecItemUpdate, SecItemDelete, kSecClassGenericPassword, kSecClassInternetPassword, kSecAttrAccessible, kSecAttrAccessGroup, Keychain access group, kSecValueData, Keychain, credential storage.

File contents

Security — Foundations Skill

Purpose

Route Keychain Services implementation tasks to the minimum required Security Knowledge Contracts. v1 scope is general (non-biometric-bound) Keychain item CRUD for kSecClassGenericPassword and kSecClassInternetPassword items — accessibility levels, access-group sharing, and storing structured/Codable data. No SecAccessControl biometric binding, no AutoFill/credential-provider extensions, no iCloud Keychain sync, no certificate/key/identity item classes.

Routing

Load only the contracts relevant to the task. All paths relative to knowledge/security/.

Calling SecItemAdd, SecItemCopyMatching, SecItemUpdate, SecItemDelete, constructing a query dictionary, or interpreting an OSStatus/errSec* result -> keychain-item-crud.md
Choosing a kSecAttrAccessible* value (.WhenUnlocked, .AfterFirstUnlock, .WhenPasscodeSetThisDeviceOnly, a ThisDeviceOnly variant, or the deprecated .Always/.AlwaysThisDeviceOnly) -> keychain-accessibility-levels.md
Setting kSecAttrAccessGroup, enabling Keychain Sharing, or sharing an item between apps/extensions from the same team -> keychain-access-groups-and-sharing.md
Encoding/decoding a Codable struct into or out of kSecValueData, or choosing between JSONEncoder and NSKeyedArchiver -> storing-structured-data-in-keychain.md

Never load more than the contracts relevant to the specific question.

Stop Conditions

Stop and report if the requested topic has no matching Knowledge Contract in knowledge/security/ — do not guess or fall back to general knowledge. Biometric-bound access control (SecAccessControlCreateWithFlags, kSecAttrAccessControl, .biometryCurrentSet/.biometryAny, kSecUseAuthenticationContext) is owned by the local-authentication Skill's knowledge.local-authentication.keychain-biometric-binding contract, not this one — route there instead. Password AutoFill / credential provider extensions, iCloud Keychain sync (kSecAttrSynchronizable), and non-password Keychain item classes (certificates, cryptographic keys, identities) are deferred, not yet built — report that explicitly rather than answering from general knowledge (see docs/architecture/domain-map.md).

---name: securitydescription: Route Keychain Services implementation tasks to the correct Knowledge Contracts -- item CRUD via SecItemAdd/SecItemCopyMatching/SecItemUpdate/SecItemDelete, accessibility levels, access groups and sharing, and storing structured/Codable data. Use when working with kSecClassGenericPassword, kSecClassInternetPassword, OSStatus, errSecSuccess, errSecItemNotFound, errSecDuplicateItem, kSecAttrAccessible, kSecAttrAccessGroup, Keychain Sharing, or kSecValueData. v1 is general (non-biometric-bound) Keychain item CRUD for generic/internet password items -- no SecAccessControl/biometric binding, no AutoFill/credential providers, no iCloud Keychain sync, no certificate/key/identity item classes. Triggers on SecItemAdd, SecItemCopyMatching, SecItemUpdate, SecItemDelete, kSecClassGenericPassword, kSecClassInternetPassword, kSecAttrAccessible, kSecAttrAccessGroup, Keychain access group, kSecValueData, Keychain, credential storage.---# Security — Foundations Skill## PurposeRoute Keychain Services implementation tasks to the minimum requiredSecurity Knowledge Contracts. v1 scope is general (non-biometric-bound)Keychain item CRUD for `kSecClassGenericPassword` and`kSecClassInternetPassword` items — accessibility levels, access-groupsharing, and storing structured/`Codable` data. No `SecAccessControl`biometric binding, no AutoFill/credential-provider extensions, no iCloudKeychain sync, no certificate/key/identity item classes.## RoutingLoad only the contracts relevant to the task. All paths relative toknowledge/security/.- Calling `SecItemAdd`, `SecItemCopyMatching`, `SecItemUpdate`, `SecItemDelete`, constructing a query dictionary, or interpreting an `OSStatus`/`errSec*` result -> keychain-item-crud.md- Choosing a `kSecAttrAccessible*` value (`.WhenUnlocked`, `.AfterFirstUnlock`, `.WhenPasscodeSetThisDeviceOnly`, a `ThisDeviceOnly` variant, or the deprecated `.Always`/`.AlwaysThisDeviceOnly`) -> keychain-accessibility-levels.md- Setting `kSecAttrAccessGroup`, enabling Keychain Sharing, or sharing an item between apps/extensions from the same team -> keychain-access-groups-and-sharing.md- Encoding/decoding a `Codable` struct into or out of `kSecValueData`, or choosing between `JSONEncoder` and `NSKeyedArchiver` -> storing-structured-data-in-keychain.mdNever load more than the contracts relevant to the specific question.## Stop ConditionsStop and report if the requested topic has no matching KnowledgeContract in knowledge/security/ — do not guess or fall back to generalknowledge. Biometric-bound access control (`SecAccessControlCreateWithFlags`,`kSecAttrAccessControl`, `.biometryCurrentSet`/`.biometryAny`,`kSecUseAuthenticationContext`) is owned by the `local-authentication`Skill's `knowledge.local-authentication.keychain-biometric-binding`contract, not this one — route there instead. Password AutoFill /credential provider extensions, iCloud Keychain sync(`kSecAttrSynchronizable`), and non-password Keychain item classes(certificates, cryptographic keys, identities) are deferred, not yetbuilt — report that explicitly rather than answering from generalknowledge (see docs/architecture/domain-map.md).

Frequently asked questions