The Agent Skills Directory

[SAFE]: The skill adheres to iOS security best practices by directing the storage of sensitive information like tokens and credentials exclusively to the Keychain, while explicitly advising against insecure storage in UserDefaults or application files.
[SAFE]: The code samples correctly utilize ASWebAuthenticationSession for third-party OAuth flows, which is the system-preferred method for maintaining security and user privacy during web-based authentication.
[INDIRECT_PROMPT_INJECTION]: The skill describes processes for handling external authentication data which serves as a potential entry point for untrusted content.
Ingestion points: Identity tokens and authorization codes received from system authentication providers in SKILL.md and references/passkeys.md.
Boundary markers: The instructions emphasize that all received tokens must be validated on a secure backend server rather than being processed as trusted input on the device.
Capability inventory: Utilization of AuthenticationServices for credential retrieval and network operations for server-side verification.
Sanitization: The skill mandates thorough validation of JWT signatures and claims (issuer, audience, and expiration) to ensure the integrity of the authentication data.

authentication