sc-crypto

Detect cryptography misuse in multi-language codebases with rule-based static analysis.

56|5|Updated Apr 8, 2026

Search Tags:#security #cryptography #code-review #key-management #weak-algorithms #ecb-mode #static-iv

Ready to run

npx skills add https://github.com/ersinkoc/security-check --skill sc-crypto

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-crypto
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-crypto
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-crypto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cryptography misuse in code leads to weakened security. This Skill detects weak algorithms, insecure modes, static IVs, weak PRNG, and improper key management to help teams fix crypto mistakes early.

Core Features & Use Cases

Detects use of weak hashes (MD5, SHA1) for security-critical operations.
Flags insecure cipher modes (ECB) and static initialization vectors.
Highlights weak PRNG and incorrect key management practices.
Real-world use: scan a codebase to surface cryptographic weaknesses and provide remediation guidance.

Quick Start

Run a scan over your repository to surface cryptography weaknesses and suggested remediations in a single report.

Frequently Asked Questions about sc-crypto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect weak encryption practices and insecure cipher modes in my codebase?▼

You can detect weak encryption practices by running rule-based static analysis over your codebase to identify insecure cipher modes like ECB, static IVs, and weak hashes. The scan outputs a structured report with remediation guidance for each finding.

What cryptographic vulnerabilities should I scan for to prevent weak encryption in code?▼

To prevent weak encryption, scan for weak hashes like MD5 and SHA1, insecure cipher modes such as ECB, static initialization vectors, weak PRNG usage, and poor key management. These cryptography misuse patterns are flagged with suggested fixes in a structured report.

Can I scan a multi-language codebase for cryptography misuse and poor key management?▼

Yes, you can scan multi-language codebases for cryptography misuse and poor key management. The analysis applies configurable patterns across different languages to surface weak PRNG, static IVs, and insecure configurations in a single structured findings report.

How do I find static IVs and weak PRNG usage across my projects?▼

Finding static IVs and weak PRNG usage across projects involves applying configurable static analysis rules to your codebase. The scan flags these cryptographic weaknesses and provides actionable remediation guidance in a consolidated report.

What is the best way to identify MD5 and SHA1 hashes used for security-critical operations?▼

The best way to identify MD5 and SHA1 hashes in security-critical operations is running a static analysis scan configured to detect weak hash algorithms. It highlights vulnerable code and outputs remediation guidance to strengthen your cryptography implementation.