# audit-xcode-security-settings

Runs a security pass over an Xcode project's build settings and switches on Clang warnings, analyzer checkers and Enhanced Security in stages. Useful when you need to harden a project.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 695 installs · ★ 352
- Author: superagents-lab
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/superagents-lab/xcode27-skills/tree/HEAD/audit-xcode-security-settings/SKILL.md
- Updated: 2026-06-09
- HTML: https://affpapa.org/en/nevibecode/skills/audit-xcode-security-settings

## What it does

The skill works through an Xcode project's build settings and turns on the security-relevant ones: Clang warnings, static analyzer checkers, Enhanced Security. Discovery, edits, questions about whatever stayed disabled, validation and a written report follow as numbered phases. Decisions land in `xcode-security-settings.md`. Languages come from file extensions: C, C++, Objective-C, Objective-C++, Swift.

Edits use whatever configuration the project already has. `.xcconfig` files get changed directly. A `.pbxproj`-only project goes through `UpdateTargetBuildSetting` and `UpdateProjectBuildSetting`. No second configuration method gets introduced. `ENABLE_ENHANCED_SECURITY` is the one exception, since it has to sit at project level.

TLS/ATS networking, code signing and privacy APIs are outside its scope. Inside the project, `ls` and `find` are banned whenever `XcodeGlob`, `XcodeGrep`, `XcodeRead` and `XcodeLS` exist, because the shell tools trigger extra permission prompts. Large `GetTargetBuildSettings` output gets filtered by `scripts/filter_build_settings.py` instead of being read top to bottom.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/audit-xcode-security-settings/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/audit-xcode-security-settings/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/audit-xcode-security-settings/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/audit-xcode-security-settings/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install superagents-lab/xcode27-skills audit-xcode-security-settings
```

2. **Manually: put the files in place**
- File: `.github/skills/audit-xcode-security-settings/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/superagents-lab/xcode27-skills --path audit-xcode-security-settings
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/audit-xcode-security-settings/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add superagents-lab/xcode27-skills --skill audit-xcode-security-settings -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/superagents-lab/xcode27-skills/tree/HEAD/audit-xcode-security-settings/SKILL.md

## When to use it
- turn on Clang warnings the project has never checked
- add static analyzer checkers without clicking through build settings
- set Enhanced Security at project level instead of per target
- record each setting decision in `xcode-security-settings.md`
- filter a huge `GetTargetBuildSettings` dump through the script

## Example prompts
- Audit the security settings in this Xcode project and enable the compiler warnings it is missing.
- Turn on Enhanced Security and the static analyzer checkers, then write the decisions to `xcode-security-settings.md`.
- Which security build settings are still off in the `.pbxproj`?

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [superagents-lab/xcode27-skills](https://affpapa.org/en/nevibecode/by/superagents-lab/xcode27-skills.md) — 7 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md