account-deletion
Generates a compliant account deletion flow for Apple apps, ensuring user data privacy and App Store compliance.
Install this skill
Security score
The account-deletion skill was audited on Mar 1, 2026 and we found 14 security issues across 2 threat categories, including 7 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Access to system keychain/keyring
| 3 | description: Generates an Apple-compliant account deletion flow with multi-step confirmation UI, optional data export, configurable grace period, Keychain cleanup, and server-side deletion request. Us |
Access to system keychain/keyring
| 9 | Generate a production account deletion flow compliant with Apple's App Store requirement (effective June 30, 2022) that any app offering account creation must also offer account deletion from within t |
Access to system keychain/keyring
| 33 | Grep: "ASAuthorizationAppleIDProvider" or "SignInWithApple" or "Keychain" or "deleteAccount" |
Access to system keychain/keyring
| 40 | ### 3. Keychain Usage Detection |
Access to system keychain/keyring
| 42 | Grep: "SecItemAdd" or "SecItemDelete" or "SecItemCopyMatching" or "KeychainWrapper" or "keychain" |
Access to system keychain/keyring
| 45 | If Keychain usage found, ensure cleanup covers all stored items. |
Access to system keychain/keyring
| 74 | - No — local-only deletion (Keychain, UserDefaults, SwiftData/CoreData, files) |
Access to system keychain/keyring
| 85 | 3. `KeychainCleanup.swift` — Utility to remove all app Keychain items |
Access to system keychain/keyring
| 108 | ├── KeychainCleanup.swift # Keychain item cleanup |
Access to system keychain/keyring
| 175 | keychainCleanup: MockKeychainCleanup() |
Access to system keychain/keyring
| 197 | func keychainItemsRemovedOnDeletion() async throws { |
Access to system keychain/keyring
| 198 | let cleanup = KeychainCleanup() |
Access to system keychain/keyring
| 249 | - **Keychain items persist after app uninstall** — You must explicitly call `SecItemDelete` for all item classes (generic password, internet password, certificate, key, identity) during account deleti |
External URL reference
| 250 | - **Sign in with Apple token revocation** — If your app supports Sign in with Apple, you must revoke the user's token via Apple's REST API (`https://appleid.apple.com/auth/revoke`). Failure to do so m |
Install this skill with one command
/learn @rshankras/account-deletion