Individual skill
detecting-weak-cryptography
Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token signing." Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: "scan weak crypto", "find MD5 usage", "check ECB mode", "audit ssl verify", "weak random".
skills/.curated/detecting-weak-cryptography/SKILL.md
Source commit 0500b275e963c027f6b410e8c49c0446945c574e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 12, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 2,917
- Repository last updated
- Nov 12, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai Repository topic
- automation Repository topic
- claude-code Repository topic
- devops Repository topic
- mcp Repository topic
- ai-agents Repository topic
- anthropic Repository topic
- claude-code-plugins Repository topic
- developer-tools Repository topic
- llm Repository topic
- security Declared skill tag
- static-analysis Declared skill tag
- cryptography Declared skill tag
- pentest Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 5,262 bytesSKILL.mdcore · 5,262 bytesSKILL.mdcore · 5,262 bytesSKILL.mdcore · 5,262 bytesreferences/PLAYBOOK.mddoc · 10,480 bytesreferences/THEORY.mddoc · 7,462 bytesscripts/scan_weak_crypto.pyruns · 14,467 bytes
Read excerpt
# Detecting Weak Cryptography
## Overview
Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic
Algorithm, CWE-330 Use of Insufficiently Random Values) shows up
when engineers use the convenient API instead of the cryptographic
one. `hashlib.md5(password)` is faster to type than the correct
bcrypt/argon2 invocation; `Math.random()` returns a number quickly
without needing to know about `crypto.randomBytes()`.
The fix is universal: use the modern primitive. SHA-256 for general
hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption,
HMAC-SHA256 for signing, `secrets` / `crypto.randomBytes` /