crypto-audit

Identify cryptographic vulnerabilities in source code with severity and CWE mappings.

1|Updated Nov 30, 2025

Search Tags:#cryptography #code-review #hashing #security-audit #key-management #weak-algorithms #timing-attacks

Ready to run

npx skills add https://github.com/MAF2414/kyco --skill crypto-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: crypto-audit
Source: https://github.com/MAF2414/kyco/tree/main/.claude/skills/crypto-audit
Command: npx skills add https://github.com/MAF2414/kyco --skill crypto-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify cryptographic vulnerabilities in source code, including weak algorithms, insecure defaults, unpredictable randomness, improper key management, and timing side channels.

Core Features & Use Cases

Weak algorithm and insecure default detection across languages.
Key management and secret handling checks including hardcoded keys.
Timing attack and non-constant-time comparison detection with remediation guidance. Use Case: Auditing a secure messaging service to catch MD5/SHA1 usage, insecure key handling, and timing vulnerabilities, and propose fixes.

Quick Start

Run a crypto-audit on your codebase to identify weaknesses and generate actionable fixes.

Frequently Asked Questions about crypto-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my source code for cryptographic vulnerabilities like weak algorithms and insecure randomness?▼

To audit source code for cryptographic vulnerabilities, the Skill scans for weak algorithms, unpredictable randomness, improper key management, and timing side channels. It outputs findings with severity levels, CWE mappings, and concrete remediation guidance.

What is a timing attack and how can I detect timing side channels in my codebase?▼

A timing attack exploits non-constant-time comparison variations. The Skill detects timing side channels in security-critical authentication and encryption code, providing remediation guidance to implement constant-time comparisons.

Can I use this to find hardcoded keys and improper key management across different programming languages?▼

Yes, you can detect hardcoded keys and improper key management across languages. The Skill applies to security-critical code across platforms, focusing on authentication, data encryption, and key handling to identify insecure defaults.

Does the security audit output integrate into existing development pipelines?▼

Yes, the security audit output integrates into development pipelines. It generates findings with severity, CWE mappings, affected assets, and remediation guidance suitable for automated processing and continuous integration.

What is the best way to catch weak hashing algorithms like MD5 or SHA1 during code review?▼

The best way to catch weak hashing algorithms like MD5 or SHA1 during code review is running an audit focused on weak algorithms and insecure defaults. It identifies vulnerable cryptographic implementations and proposes fixes.