agentic-security:security-weak-crypto

To prevent weak crypto usage, you can enable a pre-write guard that detects and blocks code edits introducing MD5, SHA1, DES, RC4, or static IVs. It halts the write and suggests secure replacements like bcrypt or AES-GCM.

Stopping unsafe password hashing requires applying a pre-write guard during code edits or generation. It detects weak primitives, blocks the write, and suggests secure alternatives such as bcrypt or argon2 for password hashing.

Yes, weak crypto detection works with symmetric encryption and IV handling by catching edits that use DES ciphers or static IVs. It blocks these writes and suggests AES-GCM with per-message IVs and secure random values.

Blocking static IVs and SHA1 in code edits prevents cryptographic weaknesses before deployment. Halting these writes during the editing phase ensures unsafe primitives are replaced with secure random values and modern algorithms.

You can use this guard to block DES ciphers and suggest secure encryption replacements. When a code edit calls DES, the skill halts the write and recommends AES-GCM with per-message IVs for secure symmetric encryption.

The limitation of this weak crypto pre-write guard is that it only applies during edits or code-generation steps. It specifically targets password hashing, symmetric encryption, and IV handling, blocking writes rather than fixing existing code.