Reviews and quality
When to run concurrency, accessibility, and security/privacy review skills.
Run review skills after the relevant code exists, and before calling shared or sensitive work complete. Prefer reading each skill’s SKILL.md for full checklists.
Suggested order after feature work
$swift-concurrency-review— if async/actors/tasks/observation isolation$apple-security-privacy-review— if files/logging/permissions/imports/sensitive data$apple-accessibility-review— if reusable SwiftUI$swift-testing-verification+ XcodeBuildMCP$maestro-apple-app-testing— for critical UI flows
Concurrency — $swift-concurrency-review
| Path | .agents/skills/swift-concurrency-review/SKILL.md |
| Use when | async/await, actors, tasks, observation across isolation, Sendable diagnostics, cancellation |
| Do not use for | Unrelated UI styling; pure synchronous API design |
Focus: Isolation map → structured concurrency → cancellation → MainActor UI → Sendable boundaries → observation pitfalls. Full ordered checklist lives in the skill.
Outputs: Severity-ranked findings/fix set, deterministic tests where practical, strict-concurrency build result when available. A review-only request does not change code.
Accessibility — $apple-accessibility-review
| Path | .agents/skills/apple-accessibility-review/SKILL.md |
| Use when | Reviewing reusable SwiftUI UI |
| Do not use for | Non-UI services; general design-token-only work; pixel-only critique |
Baseline (also always-on in AGENTS.md):
- Dynamic Type
- VoiceOver (labels, traits, order)
- Keyboard / focus order where applicable
- Contrast / Increased Contrast
- Reduce Motion
- Differentiate Without Color
- Descriptive label for icon-only controls
- Touch targets; platform differences when multi-platform
Stop condition: Do not claim automated validation for semantics the environment cannot test; list manual checks.
Security and privacy — $apple-security-privacy-review
| Path | .agents/skills/apple-security-privacy-review/SKILL.md |
| Use when | Storage, file access, logging, permissions, imports, sensitive data |
| Do not use for | Purely visual polish; unrelated API style review |
Never log: credentials, tokens, private content, raw imports, complete sensitive paths, security-scoped URLs.
Focus: Data inventory → storage placement → logging redaction → import/scoped access → entitlements → unsafe paths. Full ordered checklist lives in the skill. Distinguish user-facing recovery from developer diagnostics.