mobile-ai-agents 1.0.23

package/skills/gaming/unity-tdd.md

@@ -0,0 +1,85 @@
+# Skill — /unity-tdd
+
+**Platform:** Unity (C#)
+**Slash Command:** `/unity-tdd`
+**Composable With:** agents/gaming/forge/agent.md
+
+---
+
+## Purpose
+
+NUnit + Unity Test Runner TDD loop covering both EditMode (pure logic) and PlayMode (runtime behavior) tests. Generates failing tests first, then the minimal implementation.
+
+---
+
+## Skill Prompt
+
+```
+Run the Unity TDD loop using NUnit and Unity Test Runner:
+
+STEP 1 — RED: Write the failing test.
+- EditMode test: for pure C# logic (no MonoBehaviour, no scene needed).
+  [TestFixture] class, [Test] methods, [SetUp]/[TearDown].
+- PlayMode test: for runtime behavior requiring scene, physics, or coroutines.
+  Use UnityTest with IEnumerator return, yield return null to advance frame.
+- Use [UnitySetUp] / [UnityTearDown] for async setup in PlayMode.
+
+STEP 2 — GREEN: Minimal implementation to pass.
+STEP 3 — REFACTOR: Separate concerns, extract interfaces for testability.
+
+TESTABILITY PATTERNS FOR UNITY:
+- Avoid MonoBehaviour in business logic: extract to plain C# classes.
+- Use interfaces for dependencies (IEnemyAI, IHealthSystem) to enable mocking.
+- ScriptableObjects for data: easy to instantiate in tests without scene.
+- Time.deltaTime dependency: inject a clock abstraction (IClock.DeltaTime).
+
+Format:
+--- RED ---
+<NUnit test code>
+
+--- GREEN ---
+<minimal C# implementation>
+
+--- REFACTOR ---
+<final implementation>
+```
+
+---
+
+## Example
+
+**Input:** "TDD a HealthSystem that reduces health on damage and fires OnDeath when reaching 0"
+
+**Output:**
+```csharp
+--- RED ---
+[TestFixture]
+public class HealthSystemTests {
+    [Test]
+    public void TakeDamage_ReducesHealth() {
+        var health = new HealthSystem(maxHealth: 100);
+        health.TakeDamage(30);
+        Assert.AreEqual(70, health.Current);
+    }
+
+    [Test]
+    public void TakeDamage_ToZero_FiresOnDeath() {
+        var health = new HealthSystem(maxHealth: 100);
+        bool died = false;
+        health.OnDeath += () => died = true;
+        health.TakeDamage(100);
+        Assert.IsTrue(died);
+    }
+}
+
+--- GREEN ---
+public class HealthSystem {
+    public int Current { get; private set; }
+    public event Action OnDeath;
+    public HealthSystem(int maxHealth) => Current = maxHealth;
+    public void TakeDamage(int amount) {
+        Current = Mathf.Max(0, Current - amount);
+        if (Current == 0) OnDeath?.Invoke();
+    }
+}
+```

package/skills/ios/README.md

@@ -0,0 +1,45 @@
+# iOS Skills
+
+Reusable skill prompt modules for iOS / macOS (Swift / SwiftUI) code reviews and analysis. The most comprehensive platform coverage in the repo — 6 skills covering memory, concurrency, networking, testing, performance, and persistence.
+
+## Index
+
+| Skill | File | When to Use |
+|---|---|---|
+| Swift Code Review | [swift-review.md](swift-review.md) | ARC retain cycles, `[weak self]`, `[unowned self]`, `@MainActor`, force-unwrap |
+| SwiftUI State Management | [swiftui-state.md](swiftui-state.md) | `@State`/`@StateObject`/`@ObservedObject` selection, expensive `body`, lifecycle |
+| iOS Networking | [networking.md](networking.md) | URLSession, async/await, HTTP status checks, certificate pinning, threading |
+| iOS Unit Testing | [unit-testing.md](unit-testing.md) | Swift Testing vs XCTest, async tests, mocking with protocols |
+| iOS Performance | [performance.md](performance.md) | Main thread blocking, Core Data N+1, image decoding, background task expiration |
+| iOS Data Persistence | [data-persistence.md](data-persistence.md) | UserDefaults vs Keychain vs Core Data vs SwiftData, file encryption |
+
+## Usage
+
+Paste a skill prompt at the start of any LLM session:
+
+```
+# Focused review
+[paste skill prompt from swift-review.md]
+
+Now review this Swift class: [paste code]
+```
+
+## Composable Pattern
+
+Combine skills for a comprehensive review:
+
+```
+[paste swift-review.md skill]
+[paste swiftui-state.md skill]
+
+Review this SwiftUI ViewModel: [paste code]
+```
+
+## Composable With
+
+- [`agents/ios/swift-reviewer`](../../agents/ios/swift-reviewer/) — full structured review
+- [`agents/ios/crash-analyzer`](../../agents/ios/crash-analyzer/) — crash debugging
+
+## Contributing
+
+New skills for iOS should cover one concern. Ideas: `combine-patterns.md`, `observable-macro.md` (iOS 17+), `swift-testing-advanced.md`. Copy `templates/skill-template.md`.

package/skills/ios/data-persistence.md

@@ -0,0 +1,151 @@
+# Skill — iOS Data Persistence
+
+**Platform:** iOS / macOS (Swift)  
+**Category:** Code Quality  
+**Composable With:** agents/ios/swift-reviewer/agent.md, skills/shared/security-scan.md
+
+---
+
+## Purpose
+
+Reviews iOS data persistence code across Core Data, SwiftData, Keychain, and UserDefaults. Covers security, thread safety, migration strategy, and common pitfalls for each storage layer.
+
+## When to Use
+
+- When reviewing any code that reads from or writes to local storage
+- When adding a new persistence layer to an existing app
+- As a pre-release check for apps handling sensitive user data
+
+---
+
+## Skill Prompt
+
+```
+When reviewing iOS data persistence code, enforce these rules by storage layer:
+
+USERDEFAULTS
+- NEVER store: auth tokens, passwords, session IDs, credit card numbers, health data, or any PII.
+  UserDefaults is stored as a plaintext plist at /Library/Preferences — readable with device access.
+  Fix: use Keychain for any sensitive value.
+- @AppStorage triggers a view body re-evaluation on every write. Flag @AppStorage for large or
+  frequently-written values — use a ViewModel with debounced persistence instead.
+- Flag: UserDefaults.standard.synchronize() — deprecated, a no-op in modern iOS, and a sign
+  of cargo-cult code from older patterns.
+- Appropriate uses: user preferences (theme, language), feature flag overrides, non-sensitive app state.
+
+KEYCHAIN
+- Use Security framework (SecItemAdd, SecItemCopyMatching) or a wrapper library (KeychainAccess).
+- Set kSecAttrAccessible to kSecAttrAccessibleWhenUnlockedThisDeviceOnly for most cases.
+  Avoid kSecAttrAccessibleAlways — it persists across unlocks and is available in background.
+- Flag: Keychain items shared across apps without explicit kSecAttrAccessGroup — unintended access.
+- For biometric-protected items: use kSecAccessControlBiometryCurrentSet, not BiometryAny —
+  BiometryCurrentSet invalidates the item if a new fingerprint is enrolled (more secure).
+- Always handle errSecItemNotFound gracefully — don't crash if a Keychain item doesn't exist yet.
+
+CORE DATA
+- Context threading: NEVER access a managed object from a different context's thread.
+  viewContext is main-thread only. For background work:
+  container.performBackgroundTask { backgroundContext in ... }
+  Or: NSManagedObjectContext(concurrencyType: .privateQueueConcurrencyType)
+- Flag: NSManagedObject passed between threads without objectID re-fetch.
+  Fix: pass objectID across threads, then: let obj = backgroundContext.object(with: objectID)
+- Flag: fetchRequest without a sortDescriptor — results are non-deterministic across saves.
+- Flag: fetchRequest with no predicate fetching a large table — use predicates and fetchLimit.
+- Migration: always add a NSMersistentStoreDescription with shouldMigrateStoreAutomatically = true
+  and a lightweight migration model when adding/removing attributes.
+- Cascade delete rules: set delete rules on relationships to prevent orphaned objects.
+
+SWIFTDATA (iOS 17+)
+- @Model classes must be used with a ModelContainer — never create @Model instances outside a context.
+- Queries (@Query) run on the main actor by default. For background inserts, use ModelActor:
+  @ModelActor actor DataImporter { func insert(_ items: [Item]) throws { ... } }
+- Flag: @Model classes with large Data properties (images, files) — store file URLs, not raw data.
+- Migration: use VersionedSchema and SchemaMigrationPlan for structural changes.
+
+FILES
+- Sensitive files must be stored in the Application Support directory with NSFileProtectionComplete:
+  try data.write(to: url, options: .completeFileProtection)
+  This encrypts the file when the device is locked.
+- Flag: files written to the Documents directory without file protection — accessible via iTunes
+  sharing and potentially unencrypted on non-passcode devices.
+- Flag: large files written synchronously on the main thread.
+  Fix: use a background Task or DispatchQueue.global(qos: .utility).
+
+For each issue: state the storage layer, file/line, what is wrong, the security or correctness impact, and the corrected Swift snippet.
+```
+
+---
+
+## Example
+
+**Input:**
+```swift
+func saveToken(_ token: String) {
+    UserDefaults.standard.set(token, forKey: "authToken")
+    UserDefaults.standard.synchronize()
+}
+
+func loadToken() -> String? {
+    UserDefaults.standard.string(forKey: "authToken")
+}
+```
+
+**Output:**
+```
+CRITICAL — Auth token stored in UserDefaults (plaintext)
+  Impact: The token is stored at ~/Library/Preferences/<BundleID>.plist.
+          Any app with device access, jailbreak, or iTunes backup can read it.
+  Fix:
+  import Security
+
+  enum KeychainKey { static let authToken = "com.example.authToken" }
+
+  func saveToken(_ token: String) throws {
+      let data = Data(token.utf8)
+      let query: [CFString: Any] = [
+          kSecClass: kSecClassGenericPassword,
+          kSecAttrAccount: KeychainKey.authToken,
+          kSecValueData: data,
+          kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+      ]
+      SecItemDelete(query as CFDictionary)  // delete existing before adding
+      let status = SecItemAdd(query as CFDictionary, nil)
+      guard status == errSecSuccess else { throw KeychainError.saveFailed(status) }
+  }
+
+  func loadToken() throws -> String? {
+      let query: [CFString: Any] = [
+          kSecClass: kSecClassGenericPassword,
+          kSecAttrAccount: KeychainKey.authToken,
+          kSecReturnData: true,
+          kSecMatchLimit: kSecMatchLimitOne
+      ]
+      var result: AnyObject?
+      let status = SecItemCopyMatching(query as CFDictionary, &result)
+      guard status == errSecSuccess, let data = result as? Data else {
+          return status == errSecItemNotFound ? nil : { throw KeychainError.loadFailed(status) }()
+      }
+      return String(data: data, encoding: .utf8)
+  }
+
+WARNING — UserDefaults.synchronize() is a deprecated no-op
+  Remove it. UserDefaults persists automatically.
+```
+
+---
+
+## Composition Example
+
+```
+Combine with skills/shared/security-scan.md for a full data security audit:
+[paste data-persistence skill] + [paste security-scan skill] → paste your persistence layer.
+
+Or compose with skills/ios/networking.md when reviewing token storage after login flows.
+```
+
+---
+
+## Notes
+
+- SwiftData is the recommended persistence layer for new iOS 17+ apps. For existing Core Data apps, migration is optional but worthwhile for new features.
+- KeychainAccess (open-source library) wraps the Security framework in a clean API — recommended for readability over raw SecItem calls.

package/skills/ios/ios-tdd.md

@@ -0,0 +1,90 @@
+# Skill — /ios-tdd
+
+**Platform:** iOS (Swift)
+**Slash Command:** `/ios-tdd`
+**Composable With:** agents/ios/swift/agent.md
+
+---
+
+## Purpose
+
+Runs the red-green-refactor TDD loop for iOS — XCTest unit tests for Swift logic and XCUITest for SwiftUI component interaction. Generates the failing test first, then the minimal implementation.
+
+---
+
+## Skill Prompt
+
+```
+Run the iOS TDD loop for the described feature or function:
+
+STEP 1 — RED: Write a failing XCTest.
+- For business logic: XCTestCase with setUp/tearDown, XCTAssert* assertions.
+- For async code: use async/await test methods with `await` and XCTAssertEqual.
+- For ViewModel: mock dependencies via protocol injection.
+- For SwiftUI: use ViewInspector or XCUITest depending on complexity.
+- Test must fail for the right reason (assertion failure, not compile error).
+
+STEP 2 — GREEN: Write the minimal Swift implementation to make the test pass.
+- No over-engineering. No features not tested yet.
+
+STEP 3 — REFACTOR: Clean up. Extract protocols, add computed properties, improve naming.
+
+Format:
+--- RED ---
+<XCTest code>
+
+--- GREEN ---
+<minimal Swift implementation>
+
+--- REFACTOR ---
+<final Swift implementation>
+```
+
+---
+
+## Example
+
+**Input:** "TDD a PriceFormatter that formats Double as currency string '£12.50'"
+
+**Output:**
+```swift
+--- RED ---
+class PriceFormatterTests: XCTestCase {
+    var sut: PriceFormatter!
+    override func setUp() { sut = PriceFormatter(currencyCode: "GBP") }
+
+    func test_format_producesCorrectCurrencyString() {
+        XCTAssertEqual(sut.format(12.5), "£12.50")
+    }
+
+    func test_format_handlesZero() {
+        XCTAssertEqual(sut.format(0), "£0.00")
+    }
+}
+
+--- GREEN ---
+struct PriceFormatter {
+    let currencyCode: String
+    func format(_ amount: Double) -> String {
+        let formatter = NumberFormatter()
+        formatter.numberStyle = .currency
+        formatter.currencyCode = currencyCode
+        return formatter.string(from: NSNumber(value: amount)) ?? "\(amount)"
+    }
+}
+
+--- REFACTOR ---
+struct PriceFormatter {
+    private let formatter: NumberFormatter
+
+    init(currencyCode: String) {
+        formatter = NumberFormatter()
+        formatter.numberStyle = .currency
+        formatter.currencyCode = currencyCode
+    }
+
+    func format(_ amount: Double) -> String {
+        formatter.string(from: NSNumber(value: amount)) ?? "—"
+    }
+}
+```

package/skills/ios/networking.md

@@ -0,0 +1,139 @@
+# Skill — iOS Networking
+
+**Platform:** iOS / macOS (Swift)  
+**Category:** Code Quality  
+**Composable With:** agents/ios/swift-reviewer/agent.md, skills/shared/security-scan.md
+
+---
+
+## Purpose
+
+Reviews iOS networking code for correctness, safety, and idiomatic Swift patterns. Covers URLSession, async/await, error handling, response decoding, certificate pinning, and cancellation.
+
+## When to Use
+
+- Reviewing any class that makes HTTP requests
+- When migrating Alamofire or Combine networking to async/await
+- As a pre-code-review checklist for API client classes
+
+---
+
+## Skill Prompt
+
+```
+When reviewing iOS Swift networking code, enforce these rules:
+
+ASYNC/AWAIT PATTERNS
+- Prefer URLSession.shared.data(from:) async throws over dataTask completion handlers in new code.
+- Flag completion handler callbacks that aren't marked @escaping when they outlive the call site.
+- For cancellable requests, store a Task handle as a property and cancel in deinit or onDisappear:
+  private var fetchTask: Task<Void, Never>?
+  func load() { fetchTask?.cancel(); fetchTask = Task { try? await fetch() } }
+- Do not use URLSession in a struct that can be copied — retain the Task handle in a class or actor.
+
+ERROR HANDLING
+- Network errors should be modelled as a typed enum, not raw Error or String:
+  enum NetworkError: Error { case invalidResponse(Int), decodingFailed(Error), noConnection }
+- Flag catch { } with no body — silently swallowed network errors mask bugs.
+- Flag `try?` on network calls — it silently discards all error information. Use `do/catch`.
+- HTTP status codes must be checked: a 404 or 500 returns a URLResponse, not an error.
+  guard let httpResponse = response as? HTTPURLResponse,
+        (200..<300).contains(httpResponse.statusCode) else { throw NetworkError.invalidResponse(code) }
+
+DECODING
+- Always decode on a background thread, not MainActor, then publish the result on Main:
+  let decoded = try JSONDecoder().decode(T.self, from: data)  // runs on caller's context
+  await MainActor.run { self.result = decoded }
+- Use codingKeys or a custom dateDecodingStrategy — never rely on default ISO8601 parsing
+  without explicitly setting it: decoder.dateDecodingStrategy = .iso8601
+- Flag forced try! on JSONDecoder().decode() — server responses can always be malformed.
+
+SECURITY
+- Flag URLSession configurations with URLSessionConfiguration that disables TLS validation:
+  session.delegate implementing didReceive challenge without real certificate evaluation → MitM risk.
+- Flag http:// (cleartext) base URLs — use https:// exclusively.
+- For sensitive endpoints (auth, payment), certificate pinning must be implemented in
+  URLSession.urlSession(_:didReceive:completionHandler:).
+
+THREADING
+- URLSession completion handlers run on an arbitrary background queue by default.
+  Any UI update after a completion handler must be dispatched to the main queue.
+  With async/await + @MainActor, this is handled automatically — prefer it.
+- Flag URLSession.shared used in extensions or when a custom configuration is needed
+  (timeouts, caching policy, background transfers) — create a dedicated session instead.
+
+MEMORY
+- URLSession holds a strong reference to its delegate. The delegate must NOT hold a strong
+  reference back to the session object — this creates a retain cycle.
+  Fix: make the delegate weak (if possible) or use URLSession(configuration:) without a delegate
+  and use async/await instead.
+
+For each issue: state the file/line, what is wrong, the risk, and the corrected Swift snippet.
+```
+
+---
+
+## Example
+
+**Input:**
+```swift
+func fetchUser(id: String) {
+    URLSession.shared.dataTask(with: URL(string: "http://api.example.com/users/\(id)")!) { data, _, _ in
+        if let data = data {
+            self.user = try! JSONDecoder().decode(User.self, from: data)
+        }
+    }.resume()
+}
+```
+
+**Output:**
+```
+Line 2 — Cleartext HTTP URL
+  Risk: All traffic is intercepted in plaintext. Use https://.
+
+Line 2 — Force unwrap on URL(string:)
+  Risk: If the URL string is ever malformed (bad id encoding), the app crashes.
+  Fix: guard let url = URL(string: "https://api.example.com/users/\(id)") else { return }
+
+Line 3 — No HTTP status code check
+  Risk: A 404 or 500 response will appear as "success" — the body may not be a User.
+
+Line 3 — Strong self capture in completion handler (retain cycle risk)
+  Risk: If self is deallocated before the network call completes, accessing self.user crashes (if unowned) or leaks (if strong).
+  Fix: [weak self] guard let self else { return }
+
+Line 4 — try! on JSONDecoder
+  Risk: If the server returns an error body or schema changes, the app crashes.
+  Fix: do { self.user = try JSONDecoder().decode(User.self, from: data) } catch { /* handle */ }
+
+Line 3 — UI mutation on background queue
+  Risk: self.user likely drives the UI. Mutating it off the main thread is a data race.
+  Fix: DispatchQueue.main.async { self.user = decoded }
+
+Idiomatic async/await replacement:
+  @MainActor
+  func fetchUser(id: String) async throws {
+      guard let url = URL(string: "https://api.example.com/users/\(id)") else { return }
+      let (data, response) = try await URLSession.shared.data(from: url)
+      guard let http = response as? HTTPURLResponse, (200..<300).contains(http.statusCode) else {
+          throw NetworkError.invalidResponse((response as? HTTPURLResponse)?.statusCode ?? 0)
+      }
+      user = try JSONDecoder().decode(User.self, from: data)
+  }
+```
+
+---
+
+## Composition Example
+
+```
+Combine with skills/shared/security-scan.md for a full networking security audit:
+[paste networking skill] + [paste security-scan skill] → paste your API client class.
+```
+
+---
+
+## Notes
+
+- Alamofire adds its own validation layer (`validate()`) — when reviewing Alamofire code, check that `.validate()` is called on every request chain.
+- Background URLSession (for large uploads/downloads) requires a separate `URLSessionConfiguration.background(withIdentifier:)` — document this if used.

package/skills/ios/performance.md

@@ -0,0 +1,122 @@
+# Skill — iOS Performance
+
+**Platform:** iOS / macOS (Swift / SwiftUI / UIKit)  
+**Category:** Performance & Optimization  
+**Composable With:** agents/ios/swift-reviewer/agent.md, skills/ios/swiftui-state.md
+
+---
+
+## Purpose
+
+Reviews iOS code for common performance pitfalls: main thread blocking, expensive view body, Core Data N+1 queries, image loading overhead, and background task misuse. Use as a pre-profiling code review before reaching for Instruments.
+
+## When to Use
+
+- When a screen feels laggy or slow to appear
+- Before profiling with Instruments (eliminate obvious issues first)
+- When reviewing any code that touches Core Data, images, or the main thread
+
+---
+
+## Skill Prompt
+
+```
+When reviewing iOS Swift code for performance, check for:
+
+MAIN THREAD VIOLATIONS
+- Disk I/O (FileManager, UserDefaults, CoreData fetch without async) on the main thread blocks
+  the UI thread. Any operation that could take >1ms must be on a background actor or DispatchQueue.global().
+- URLSession.shared.dataTask result handling that mutates UI without dispatching to main.
+- JSONDecoder().decode() on large payloads on the main thread — move to a Task { } or background queue.
+- Flag: try FileManager.default.contentsOfDirectory(...) called directly in viewDidLoad or body.
+
+SWIFTUI VIEW BODY
+- body is called frequently. It must be a pure, cheap computation.
+- Flag: DateFormatter() or NumberFormatter() instantiated inside body — these are expensive to create.
+  Fix: store as @State private var formatter = ... or as a static property.
+- Flag: sorting, filtering, or mapping large arrays inside body.
+  Fix: use .onChange(of:) to recompute and store in @State, or use a ViewModel computed property with caching.
+- Flag: body reading from UserDefaults directly — triggers a body re-evaluation on every read
+  if wrapped in @AppStorage, but UserDefaults is also synchronous disk access.
+
+CORE DATA / SWIFTDATA
+- N+1 query: fetching a list of objects, then accessing a relationship on each object in a loop
+  without prefetching. Each relationship access fires a new fetch.
+  Fix: set fetchRequest.relationshipKeyPathsForPrefetching = ["items"] to batch-load relationships.
+- Fetching on the main context (viewContext) — heavy fetches block the UI.
+  Fix: use NSManagedObjectContext.perform { } or fetch on a background context with
+  PersistenceController.shared.container.performBackgroundTask { context in ... }
+- Saving on every change instead of batching — each save triggers a write to disk.
+  Fix: batch saves with a debounced save call or save on significant lifecycle events only.
+
+IMAGE LOADING
+- Loading UIImage(named:) for large images synchronously on the main thread blocks rendering.
+  Fix: use async image loading (AsyncImage in SwiftUI, or a library like Kingfisher/Nuke).
+- Decoding full-resolution images for thumbnail display — decoding a 4K image to show in a 80×80 cell wastes memory and CPU.
+  Fix: use ImageIO to decode at target size:
+  let options: [CFString: Any] = [kCGImageSourceThumbnailMaxPixelSize: 80,
+                                   kCGImageSourceCreateThumbnailFromImageAlways: true]
+- Not reusing images — storing UIImage objects without a cache in a list causes repeated disk reads.
+
+BACKGROUND TASKS
+- BGTaskScheduler tasks that do work on the main thread inside the task handler.
+  Fix: dispatch all work to a background thread inside the handler; call setTaskCompleted() in ALL code paths.
+- Long-running background tasks (>30 seconds) that don't call setTaskCompleted() fast enough — watchdog kills the app (0x8badf00d).
+- Doing CoreLocation, HealthKit, or CloudKit fetches in a UIBackgroundTask without proper expiration handling.
+
+COLLECTION VIEW / TABLE VIEW
+- dequeueReusableCell not called — creating new cells on every cellForRow is O(n) allocation per scroll event.
+- Synchronous image loading inside cellForRow/itemForIndexPath — each scroll event blocks the main thread.
+  Fix: load images asynchronously and cancel on cell reuse (store the task in prepareForReuse).
+- Recalculating cell heights in heightForRowAt with expensive layout passes — cache heights.
+
+For each issue: state the file/line, the performance impact (what it blocks or how often it runs), and the corrected code.
+```
+
+---
+
+## Example
+
+**Input:**
+```swift
+struct PostListView: View {
+    let posts: [Post]
+
+    var body: some View {
+        let sorted = posts.sorted { $0.date > $1.date }  // every rebuild
+        List(sorted) { post in
+            Text(DateFormatter().string(from: post.date))  // new formatter per cell
+        }
+    }
+}
+```
+
+**Output:**
+```
+body — sorted array computed on every rebuild
+  Impact: .sorted is O(n log n). With 500 posts, this runs on every body call triggered
+          by any parent state change, causing visible lag during scroll.
+  Fix:
+  // In ViewModel or parent:
+  @State private var sortedPosts = posts.sorted { $0.date > $1.date }
+  // Update only when posts changes with .onChange(of: posts) { sortedPosts = ... }
+
+body — DateFormatter instantiated per cell per rebuild
+  Impact: DateFormatter initialization is expensive (locale setup, calendar, timezone).
+          With 20 visible cells and frequent rebuilds, this creates hundreds of objects per second.
+  Fix:
+  private static let dateFormatter: DateFormatter = {
+      let f = DateFormatter()
+      f.dateStyle = .medium
+      return f
+  }()
+  // Or use .formatted() with a FormatStyle (no allocation):
+  Text(post.date.formatted(date: .abbreviated, time: .omitted))
+```
+
+---
+
+## Notes
+
+- Instruments > Time Profiler is the ground truth for main thread blocking — use this skill for pre-profiling review, not as a replacement for measurement.
+- SwiftUI's view body performance has improved significantly in iOS 17 with the `@Observable` macro — less state change propagation overhead compared to `ObservableObject`.

package/skills/ios/swift-concurrency.md

@@ -0,0 +1,57 @@
+# Skill — /swift-concurrency
+
+**Platform:** iOS (Swift)
+**Slash Command:** `/swift-concurrency`
+
+---
+
+## Purpose
+
+Safely converts completion handler callbacks to Swift async/await. Handles nested callbacks, error mapping, DispatchQueue patterns, and Combine pipelines.
+
+---
+
+## Skill Prompt
+
+```
+Convert the provided Swift completion handler code to async/await safely:
+
+CONVERSION PATTERNS:
+1. Simple callback → async function:
+   func fetchUser(id: String, completion: @escaping (User?, Error?) -> Void)
+   → func fetchUser(id: String) async throws -> User
+
+2. Result-based callback → async throws:
+   func loadData(completion: @escaping (Result<Data, Error>) -> Void)
+   → func loadData() async throws -> Data
+
+3. Nested callbacks → sequential await:
+   Flatten callback pyramids into sequential async calls.
+
+4. DispatchQueue.main.async callback → @MainActor:
+   func updateUI() { DispatchQueue.main.async { self.label.text = "done" } }
+   → @MainActor func updateUI() { label.text = "done" }
+
+5. Withstand continuations for legacy APIs:
+   Use withCheckedThrowingContinuation for APIs you can't change:
+   func legacyFetch() async throws -> Data {
+       try await withCheckedThrowingContinuation { continuation in
+           legacyAPI.fetch { data, error in
+               if let error { continuation.resume(throwing: error) }
+               else { continuation.resume(returning: data!) }
+           }
+       }
+   }
+
+6. Combine → AsyncStream / async sequence:
+   publisher.values async sequence in for await loops.
+
+SAFETY CHECKLIST:
+- [ ] continuation.resume called exactly once (not zero, not twice)
+- [ ] No @escaping closures capturing self strongly after async conversion
+- [ ] @MainActor added to functions that update UI
+- [ ] Task { } used only when fire-and-forget is intentional; add error handling
+
+Show before and after for each function converted. Flag any pattern that cannot be
+safely converted without changing the calling contract.
+```