Cryptotokenkit

{
  "skill_name": "cryptotokenkit",
  "evals": [
    {
      "id": 0,
      "prompt": "Review this macOS smart-card login extension plan: create an iOS token driver target with TKTokenDriver, put com.apple.ctk.driver-class at the top level of Info.plist, share one PIN-authenticated state across token sessions, and register it by launching the normal app as the current user.",
      "expected_output": "A correction-focused CryptoTokenKit review that keeps system smart-card authentication on macOS, uses the smart-card token extension classes and Info.plist nesting, registers through _securityagent, and preserves per-session authentication state.",
      "files": [],
      "expectations": [
        "States that the smart-card app extension flow for system login and keychain unlock is a macOS workflow, not an iOS token driver target.",
        "Uses TKSmartCardTokenDriver, TKSmartCardToken, and TKSmartCardTokenSession for smart-card token extensions.",
        "Places com.apple.ctk.driver-class under NSExtension > NSExtensionAttributes and uses NSExtensionPointIdentifier com.apple.ctk-tokens.",
        "Registers the extension by launching the host app as the _securityagent user during installation.",
        "Warns not to share PIN or authentication state across TKTokenSession instances.",
        "Does not drift into generic Sign in with Apple, passkey, or OAuth authentication guidance."
      ]
    },
    {
      "id": 1,
      "prompt": "I'm building an iOS 26 app that reads a contactless PIV smart card over NFC and wants to keep a token-backed keychain reference for later signing. What CryptoTokenKit APIs and availability checks should I use?",
      "expected_output": "An iOS 26 CryptoTokenKit plan that uses TKSmartCardSlotManager NFC sessions, TKSmartCard APDU communication, TKSmartCardTokenRegistrationManager, kSecAttrTokenID keychain queries, persistent-reference handling, and explicit availability/access guards.",
      "files": [],
      "expectations": [
        "States that createNFCSlot(message:completion:) and isNFCSupported() are iOS/iPadOS 26+ APIs.",
        "Guards TKSmartCardSlotManager.default and isNFCSupported() before creating an NFC smart-card slot.",
        "Uses the TKSmartCardSlotNFCSession slotName to obtain a TKSmartCardSlot and TKSmartCard for APDU communication.",
        "Ends the NFC session with TKSmartCardSlotNFCSession.end().",
        "Uses TKSmartCardTokenRegistrationManager for iOS 26+ smart-card registration instead of inventing custom persistence.",
        "Uses kSecAttrTokenID, TKTokenWatcher, and errSecItemNotFound handling for token-backed keychain references."
      ]
    },
    {
      "id": 2,
      "prompt": "I need to add hardware-token certificate auth, passkeys, Secure Enclave key generation, and certificate pinning to an iOS app. Which parts belong in CryptoTokenKit, and what should move to sibling skills?",
      "expected_output": "A boundary-aware routing answer that keeps CryptoTokenKit focused on token-backed smart-card/keychain workflows, routes passkeys and user-facing account auth to authentication, and routes Secure Enclave, CryptoKit, Keychain storage architecture, and certificate pinning to swift-security.",
      "files": [],
      "expectations": [
        "Keeps CryptoTokenKit focused on security tokens, smart cards, token sessions, token-backed keychain items, and certificate-based smart-card authentication.",
        "Routes passkeys/WebAuthn and user-facing account sign-in flows to the authentication skill.",
        "Routes Secure Enclave key generation, CryptoKit primitives, keychain storage architecture, and certificate pinning/trust policy to swift-security.",
        "Explains that token-backed keychain items are queried with kSecAttrTokenID when a token is present.",
        "Mentions that normal token presence/removal should be tracked with TKTokenWatcher.",
        "Does not broaden CryptoTokenKit into a general mobile security or account-authenticatio