Ios NetworkingSAFE

A collection of Agent Skills Standard and Best Practice for Programming Languages, Frameworks that help our AI Agent follow best practies on frameworks and programming laguages

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ios-networking
description: Build API clients with URLSession, Alamofire, and Codable. Use when implementing URLSession networking, Alamofire, or API clients in iOS.
metadata:
  triggers:
    files:
    - '**/*Service.swift'
    - '**/*API.swift'
    - '**/*Client.swift'
    keywords:
    - URLSession
    - Alamofire
    - Moya
    - URLRequest
    - URLComponents
    - Codable
---
# iOS Networking

## **Priority: P0 (CRITICAL)**

## Implementation Workflow

1. **Choose networking layer** — Use native `URLSession` with async/await for simple apps; `Alamofire` for production APIs with interceptors.
2. **Build URLs safely** — Use `URLComponents` and `URLQueryItem`; never use string interpolation for URL parameters.
3. **Decode with Codable** — Use `Codable` for all JSON mapping. Prefer `snake_case` key decoding strategies.
4. **Add auth interceptor** — Use `RequestInterceptor` to inject `Authorization: Bearer <token>` on all requests.
5. **Handle token refresh** — On 401, use `RequestInterceptor.onRetry` to call `refreshToken()` and retry.
6. **Pin certificates** — Use `ServerTrustManager` or `TrustKit` for production-grade security.

See [URLSession and Alamofire implementation examples](references/implementation.md)

## Anti-Patterns

- **No Background UI Updates**: Always dispatch to `@MainActor` or main queue
- **No Manual `JSONSerialization`**: Use `Codable` and `JSONDecoder`
- **No Missing Timeouts**: Set reasonable `timeoutInterval` (30s default)

## References

- [Native & Alamofire Implementation](references/implementation.md)

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.