What problem does it solve? Front-end encryption, signing, and key storage often look secure in the browser while the server blindly trusts client-side decisions. This Skill provides a disciplined, evidence-gated workflow to verify whether Web Crypto usage, randomness, token derivation, and downgrade handling actually leave security decisions on the client. ## Core Features & Use Cases - Evidence-Gated Validation: Enforces a fixed baseline → single-variable probe → post-baseline → oracle → evidence sequence so findings are reproducible and false positives (minified strings, algorithm names, front-end checks) are filtered out. - Client-Side Crypto Boundary Testing: Examines Web Crypto API calls, hardcoded key material, weak randomness, in-browser signatures, and key storage to determine whether the server independently validates security-critical inputs. - Safe Scope Control: Restricts testing to owned accounts, canaries, and approved rates, with explicit stop conditions for key extraction, token forgery, and third-party data, plus routing to JWT, webhook-signature, and DOM specialist skills. - Use Case: During an authorized web assessment, you notice a bundle deriving request signatures in the browser. Use this Skill to plan a minimal probe that checks whether the server accepts a self-generated boundary input it should reject, then capture the bundle hash, data flow, and server decision as evidence. ## Quick Start Use $hunt-web-crypto to plan an evidence-gated, authorized validation of the client-side encryption and signing logic in the in-scope web application.
