Scan application code and configuration for cryptography and secrets hygiene issues.
npx skills add https://github.com/superagent-ai/skills --skill crypto-secrets
Please help me install this Agent Skill. Skill: crypto-secrets Source: https://github.com/superagent-ai/skills/tree/main/skills/crypto-secrets Command: npx skills add https://github.com/superagent-ai/skills --skill crypto-secrets
Audit application source code and configuration for cryptography and secrets hygiene issues: hardcoded API keys, committed .env files, private keys, weak hashes, insecure encryption modes, unsafe randomness, bad KDF/password hashing, JWT signing mistakes, disabled TLS verification, and dangerous serialization. Runs a dependency-free offline scanner for high-recall findings, then the model confirms impact and writes concrete fixes with redacted evidence. Use when reviewing app code that handles encryption, tokens, sessions, certificates, or credentials; when asked to scan for hardcoded secrets, exposed API keys, weak crypto, AES-ECB/CBC misuse, MD5/SHA1 password hashing, insecure random tokens, verify=False, InsecureSkipVerify, rejectUnauthorized false, alg none JWTs, or committed private keys. Not for Terraform/Kubernetes-only audits (use infra-security), package install-hook risk (use supply-chain-security), or vetting an agent skill before install (use skill-security).
Run the crypto-secrets scanner on your target directory to detect hardcoded keys and weak crypto.
High-intent search queries and answers about installing and using this skill.
To scan source code for hardcoded secrets and weak cryptography, run an offline deterministic scanner that flags secret signatures and insecure crypto patterns, followed by model-driven verification to confirm impact and generate redacted remediation evidence.
Static analysis finds insecure JWT and TLS misconfigurations by deterministically scanning code for patterns like alg none JWTs, verify=False, and rejectUnauthorized false, then applying semantic judgment to assess exploitability and craft concrete fixes.
Yes, you can audit cryptography hygiene across multiple languages and environments using a dependency-free offline scanner that flags weak hashes, unsafe randomness, and bad KDF password hashing, followed by model-driven verification of each finding.
The best way to detect AES-ECB misuse and MD5 password hashing is a two-stage workflow: a deterministic scanner flags weak crypto candidates, then the model confirms exploitability and writes concrete remediations with redacted secret values.
You should not use a cryptography secrets scanner for Terraform or Kubernetes-only audits, package install-hook risk analysis, or agent skill vetting, as it specifically targets application source code and configuration handling encryption, tokens, and credentials.
No, the secrets audit scanner runs a dependency-free offline scanner for high-recall findings during its first stage, ensuring static analysis works without requiring external packages or network access to flag weak crypto and secret signatures.
TheBushidoCollectiveEnforce encryption, key management, and access controls for Fnox secrets.
kernex-devAudit codebases and configurations to identify vulnerabilities with structured findings.
AkbarDevopAudit infrastructure security for leaked credentials, supply chain risks, and CI/CD issues.
fishyerReview AI agent skill source, code, and permissions to classify risk levels.
