What problem does it solve? Cryptographic code often contains subtle defects—weak modes, predictable nonces, hardcoded keys, or plaintext leaking into logs—that manual review easily misses. This Skill provides a structured static review workflow plus a heuristic scanner to surface candidate issues across a codebase. ## Core Features & Use Cases - Heuristic Triage Scanner: The bundled Python script scans source files for crypto APIs, weak algorithms (ECB, DES, MD5), weak randomness (Math.random, java.util.Random), hardcoded secrets, and plaintext sinks, outputting Markdown or JSON with file and line locations. - Structured Review Workflow: Eight-step methodology covering crypto inventory, call-graph tracing, encryption construction, randomness/nonces, KDF parameters, key handling, envelope binding, and plaintext sinks. - Severity-Rated Findings: Findings follow a CRYPTO-IMPL-### schema with critical/high/medium/low severity, evidence requirements, and retest steps grounded in OWASP and NIST baselines. - Use Case: Before shipping an end-to-end encrypted feature, run the scanner over the repository, then trace each candidate from user input through encrypt/decrypt calls to logs and storage to confirm or dismiss real vulnerabilities. ## Quick Start Set JIG_CRYPTO_SKILL_DIR to this skill's directory and ask the agent to run the crypto static scan against the repository root, then review and confirm each candidate finding with file and line evidence.
