insufficient-randomness-anti-pattern

Identifies weak random number generators in security-sensitive code and suggests CSPRNGs.

8|1|Updated Jan 19, 2026

Search Tags:#code review #security #vulnerability #randomness #token generation #CSPRNG

Ready to run

npx skills add https://github.com/igbuend/grimbard --skill insufficient-randomness-anti-pattern

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insufficient-randomness-anti-pattern
Source: https://github.com/igbuend/grimbard/tree/main/skills/insufficient-randomness-anti-pattern
Command: npx skills add https://github.com/igbuend/grimbard --skill insufficient-randomness-anti-pattern

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical security vulnerability of using predictable, non-cryptographic random number generators for security-sensitive values, which can lead to token forgery and system compromise.

Core Features & Use Cases

Identifies weak PRNGs: Detects the use of Math.random(), Python's random module, and similar predictable generators in security contexts.
Provides secure alternatives: Offers examples and guidance on using cryptographically secure pseudo-random number generators (CSPRNGs) like crypto.randomBytes() (Node.js), secrets (Python), and SecureRandom (Java).
Use Case: When reviewing code that generates session IDs, API keys, or password reset tokens, this skill helps ensure that truly unpredictable values are used, preventing attackers from guessing or deriving these sensitive identifiers.

Quick Start

Use the insufficient-randomness-anti-pattern skill to review the attached code for insecure random number generation.

Frequently Asked Questions about insufficient-randomness-anti-pattern

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect weak random number generators in security-sensitive code?▼

To detect weak random number generators in security-sensitive code, review the logic for predictable functions like Math.random() or Python's random module when generating tokens, session IDs, or encryption keys to identify predictable values.

Why does using Math.random() for token generation create a security vulnerability?▼

Using Math.random() for token generation creates a vulnerability because it relies on predictable pseudo-random number generators, allowing attackers to guess or derive sensitive identifiers and compromise the system through token forgery.

What's the best way to securely generate session IDs and password reset tokens?▼

The best way to securely generate session IDs and password reset tokens is to replace weak PRNGs with cryptographically secure pseudo-random number generators (CSPRNGs) like crypto.randomBytes() in Node.js or secrets in Python to ensure adequate entropy.

Can I use Python's random module for generating API keys?▼

You cannot use Python's random module for generating API keys because it is a non-cryptographic generator. You must use the cryptographically secure secrets module instead to ensure the generated API keys are truly unpredictable.

Does Java have a built-in cryptographically secure pseudo-random number generator?▼

Java provides the SecureRandom class as a built-in cryptographically secure pseudo-random number generator (CSPRNG). You should use SecureRandom instead of standard random classes to enforce adequate entropy for robust security.

When should I not use standard random number generation in my code?▼

You should not use standard random number generation in security-sensitive contexts such as creating session IDs, API keys, or encryption keys. Standard PRNGs lack the necessary entropy and must be replaced with language-specific CSPRNGs to prevent attacks.