skills.rest
MAF2414
MAF2414COMMUNITY
Explore all skills by this author →
GitHub

crypto-audit

Identify cryptographic vulnerabilities in source code with severity and CWE mappings.

1|Updated Nov 30, 2025
Search Tags:#cryptography#code-review#hashing#security-audit#key-management#weak-algorithms#timing-attacks
One-click install
npx skills add https://github.com/MAF2414/kyco --skill crypto-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: crypto-audit
Source: https://github.com/MAF2414/kyco/tree/main/.claude/skills/crypto-audit
Command: npx skills add https://github.com/MAF2414/kyco --skill crypto-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify cryptographic vulnerabilities in source code, including weak algorithms, insecure defaults, unpredictable randomness, improper key management, and timing side channels.

Core Features & Use Cases

  • Weak algorithm and insecure default detection across languages.
  • Key management and secret handling checks including hardcoded keys.
  • Timing attack and non-constant-time comparison detection with remediation guidance. Use Case: Auditing a secure messaging service to catch MD5/SHA1 usage, insecure key handling, and timing vulnerabilities, and propose fixes.

Quick Start

Run a crypto-audit on your codebase to identify weaknesses and generate actionable fixes.

Frequently Asked Questions about crypto-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my source code for cryptographic vulnerabilities like weak algorithms and insecure randomness?▼

To audit source code for cryptographic vulnerabilities, the Skill scans for weak algorithms, unpredictable randomness, improper key management, and timing side channels. It outputs findings with severity levels, CWE mappings, and concrete remediation guidance.

What is a timing attack and how can I detect timing side channels in my codebase?▼

A timing attack exploits non-constant-time comparison variations. The Skill detects timing side channels in security-critical authentication and encryption code, providing remediation guidance to implement constant-time comparisons.

Can I use this to find hardcoded keys and improper key management across different programming languages?▼

Yes, you can detect hardcoded keys and improper key management across languages. The Skill applies to security-critical code across platforms, focusing on authentication, data encryption, and key handling to identify insecure defaults.

Does the security audit output integrate into existing development pipelines?▼

Yes, the security audit output integrates into development pipelines. It generates findings with severity, CWE mappings, affected assets, and remediation guidance suitable for automated processing and continuous integration.

What is the best way to catch weak hashing algorithms like MD5 or SHA1 during code review?▼

The best way to catch weak hashing algorithms like MD5 or SHA1 during code review is running an audit focused on weak algorithms and insecure defaults. It identifies vulnerable cryptographic implementations and proposes fixes.

Related Skills

Explore More Software Engineering Skills→
CyberSecAICyberSecAI
1

cryptography

Detect cryptography weaknesses and map findings to ASVS-aligned rules.

Official
Basic
jeanlucianojeanluciano
20

Security Auditing

Audit security vulnerabilities in codebases, configurations, and APIs against OWASP Top 10.

Community
Advanced
rnavarychrnavarych
14

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

Community
Advanced
AndyAnh174AndyAnh174

SSH Penetration Testing

Enumerates SSH configurations and tests credentials with Nmap, Hydra, and ssh-audit.

Community
Advanced