/axiom-security

name: axiom-security
description: Use when storing credentials securely, encrypting data, implementing passkeys, securing AI/agentic features against prompt injection, code signing, or managing certificates and provisioning profiles.
license: MIT

Security & Credentials

**You MUST use this skill for ANY keychain, encryption, passkey, app integrity, agentic/AI feature security, file protection, or code signing work.**

<!-- AXIOM_AUDITOR_INLINE_BEGIN — rewritten for Codex by scripts/build-codex.ts; do not hand-edit --> > **Auditors are skills here.** Where this router says "Launch `some-auditor` agent", invoke the > matching Codex skill instead — same procedure, no Claude Code agent required. > > Available: `axiom-scan-security-privacy`. > > The ones that shell out — builds, tests, simulators, crash symbolication — need shell access to run. <!-- AXIOM_AUDITOR_INLINE_END -->

Quick Reference

| Symptom / Task | Reference | |----------------|-----------| | Store tokens, passwords, API keys securely | See `skills/keychain.md` | | Choose kSecAttrAccessible level, biometric protection | See `skills/keychain.md` | | SecItem function signatures, attribute constants | See `skills/keychain-ref.md` | | errSecDuplicateItem, errSecItemNotFound, errSecInteractionNotAllowed | See `skills/keychain-diag.md` | | Encrypt data, sign payloads, key management | See `skills/cryptokit.md` | | Hash functions, HMAC, AES-GCM, ChaChaPoly, ECDSA, EdDSA, key agreement | See `skills/cryptokit-ref.md` | | Passkey sign-in, WebAuthn, ASAuthorizationController | See `skills/passkeys.md` | | One-time code AutoFill for credential providers `OS27` | See `skills/passkeys.md` (Delivered Verification Codes) | | App integrity verification, DCAppAttestService, fraud metric | See `skills/app-attest.md` | | Prompt injection, securing AI agents / agentic features, tool confirmation | See `skills/agentic-security.md` | | NSFileProtection levels, data protection at rest | See `skills/file-protection-ref.md` | | SensitiveContentAnalysis verdict must never leave the device (no analytics/moderation queue/synced cache; license §3.3.3) | See `axiom-vision` (skills/vision-ref.md) | | Certificate management, provisioning profiles, CI/CD signing | See `skills/code-signing.md` | | Certificate not found, profile mismatch, entitlement errors | See `skills/code-signing-diag.md` | | Certificate CLI, profile inspection, entitlement extraction | See `skills/code-signing-ref.md` | | Apple Pay payment certs / pass type certs / Tap to Pay entitlement | See `axiom-payments` suite |

Decision Tree

digraph security {
    start [label="Security task" shape=ellipse];
    what [label="What do you need?" shape=diamond];

    start -> what;
    what -> "skills/keychain.md" [label="store/retrieve\ncredentials, tokens,\nsecrets"];
    what -> "skills/keychain-ref.md" [label="SecItem API syntax,\nattribute constants,\naccess levels"];
    what -> "skills/keychain-diag.md" [label="keychain errors\n(errSec codes)"];
    what -> "skills/cryptokit.md" [label="encrypt data,\nsign payloads,\nSecure Enclave keys"];
    what -> "skills/cryptokit-ref.md" [label="CryptoKit API\n(AES, ECDSA, HPKE,\npost-quantum)"];
    what -> "skills/passkeys.md" [label="passkey sign-in,\nreplace passwords"];
    what -> "skills/app-attest.md" [label="app integrity,\nfraud prevention"];
    what -> "skills/agentic-security.md" [label="AI agent security,\nprompt injection"];
    what -> "skills/file-protection-ref.md" [label="file encryption,\nNSFileProtection"];
    what -> "skills/code-signing.md" [label="set up signing,\nprofiles, CI/CD"];
    what -> "skills/code-signing-diag.md" [label="signing errors,\nupload rejections"];
    what -> "skills/code-signing-ref.md" [label="CLI commands,\nprofile inspection"];
}

1. Store tokens, passwords, API keys securely? → `skills/keychain.md` 1a. Need SecItem function signatures, attribute constants? → `skills/keychain-ref.md` 1b. Keychain errors (errSecDuplicateItem, errSecItemNotFound)? → `skills/keychain-diag.md` 2. Encrypt data, sign payloads, manage keys? → `skills/cryptokit.md` 2a. Need CryptoKit API details (AES-GCM, ECDSA, HPKE, post-quantum)? → `skills/cryptokit-ref.md` 3. Implement passkey sign-in, replace passwords? → `skills/passkeys.md` 4. Verify app integrity, prevent fraud? → `skills/app-attest.md` 5. Securing an agentic/AI feature (prompt injection, tool confirmation, lock-screen intents)? → `skills/agentic-security.md` 6. File encryption at rest, NSFileProtection levels? → `skills/file-protection-ref.md` 7. Set up code signing, manage certificates, CI/CD? → `skills/code-signing.md` 7a. Code signing error troubleshooting? → `skills/code-signing-diag.md` 7b. Certificate CLI commands, profile inspection? → `skills/code-signing-ref.md` 8. Build/upload failures after signing? → See axiom-build 9. App Store submission prep? → `/skill axiom-shipping` 10. Privacy manifests, tracking transparency? → See axiom-integration 11. Data persistence (SwiftData, Core Data, storage strategy)? → `/skill axiom-data` 12. TLS configuration, certificate pinning for network requests? → `/skill axiom-networking` 13. Want automated security scan? → security-privacy-scanner (Agent)

Conflict Resolution

**security vs axiom-build**: When build fails with signing errors:

• Code signing errors (certificate, profile, entitlement) → **use security**
• Environment issues (Xcode version, simulator, Derived Data) → **use axiom-build**
• If unsure, check the error message: `CODESIGN`, `ITMS-90xxx`, `errSec` → **security**

**security vs shipping**: When preparing for App Store:

• Privacy manifests, submission checklists, rejections → **use shipping**
• Code signing for distribution, certificate management → **use security**

**security vs axiom-data**: When storing sensitive data:

• Tokens, passwords, API keys → **use security** (keychain)
• User preferences, non-sensitive settings → **use axiom-data** (UserDefaults/SwiftData)
• File en