Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Crypto Analyzer Skill · a5c-ai | DecimalAI

a5c-ai/crypto-analyzer

SkillScore84Maintained

Cryptographic implementation analysis and validation for encryption algorithms, key sizes, and certificate management

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-crypto-analyzer/SKILL.md

decimalai skills pull a5c-ai-crypto-analyzer --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-crypto-analyzer/SKILL.md https://app.decimal.ai/s/a5c-ai-crypto-analyzer/SKILL.md

Raw file: /s/a5c-ai-crypto-analyzer/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-crypto-analyzer.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 29d ago

Yes — +48% lift · at higher cost+43% tokens0% turns84% of whole cases pass with skill (21/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	-35%	0%
case-03	✗→✓	▲ Improved	16%	0%
case-10	✗→✓	▲ Improved	91%	0%
case-11	✗→✓	▲ Improved	80%	0%
case-16	✗→✓	▲ Improved	43%	0%

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/crypto-analyzer/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Crypto Analyzer Skill

Purpose

Analyze and validate cryptographic implementations to ensure proper algorithm usage, key sizes, certificate validity, and compliance with cryptographic best practices and standards.

Capabilities

Encryption Implementation Analysis

Analyze symmetric encryption usage (AES, ChaCha20)
Review asymmetric encryption implementations (RSA, ECDSA)
Check encryption mode selection (GCM, CBC, CTR)
Validate initialization vector (IV) handling
Verify padding schemes
Identify insecure encryption patterns

Algorithm Strength Validation

Check algorithm deprecation status
Validate against NIST recommendations
Compare with FIPS 140-3 requirements
Assess quantum resistance readiness
Flag weak or deprecated algorithms
Recommend algorithm upgrades

Key Size Verification

Validate RSA key lengths (minimum 2048-bit)
Check ECC curve selections
Verify symmetric key sizes
Assess key derivation functions
Check PBKDF2/scrypt/bcrypt parameters
Validate key stretching implementations

Deprecated Algorithm Detection

Identify MD5 and SHA-1 usage
Flag DES and 3DES usage
Detect RC4 stream cipher
Find weak random number generation
Identify export-grade cryptography
Flag custom/homegrown crypto

Certificate Analysis

Verify certificate validity periods
Check certificate chain completeness
Validate certificate key usage
Detect wildcard certificate risks
Check certificate transparency logs
Monitor certificate expiration

Cryptographic Recommendations

Suggest algorithm replacements
Recommend key size upgrades
Provide implementation guidance
Map to compliance requirements
Generate migration plans
Prioritize remediation efforts

Algorithm Assessment

Symmetric Encryption

| Algorithm | Status | Recommendation | |-----------|--------|----------------| | AES-256-GCM | Approved | Preferred | | AES-128-GCM | Approved | Acceptable | | ChaCha20-Poly1305 | Approved | Preferred for mobile | | AES-CBC | Caution | Use with HMAC | | 3DES | Deprecated | Replace immediately | | DES | Prohibited | Critical risk |

Asymmetric Encryption

| Algorithm | Min Key Size | Recommendation | |-----------|-------------|----------------| | RSA | 2048-bit | 3072+ preferred | | ECDSA | P-256 | P-384 preferred | | Ed25519 | N/A | Recommended |

Hash Functions

| Algorithm | Status | Use Case | |-----------|--------|----------| | SHA-256/384/512 | Approved | General use | | SHA-3 | Approved | High security | | BLAKE2 | Approved | Performance | | SHA-1 | Deprecated | Legacy only | | MD5 | Prohibited | Never use |

Integrations

OpenSSL: Cryptographic library analysis
testssl.sh: TLS configuration testing
SSL Labs API: Certificate and TLS analysis
Cryptographic libraries: Language-specific crypto review
HSM interfaces: Hardware security module validation

Target Processes

Cryptography and Key Management Process
Security Code Review
TLS Configuration Hardening
Certificate Lifecycle Management

Input Schema

json
{
  "type": "object",
  "properties": {
    "analysisType": {
      "type": "string",
      "enum": ["code-review", "tls-config", "certificate", "implementation", "compliance"],
      "description": "Type of cryptographic analysis"
    },
    "targetPath": {
      "type": "string",
      "description": "Path to code or configuration to analyze"
    },
    "endpoints": {
      "type": "array",
      "items": { "type": "string" },
      "description": "TLS endpoints to analyze"
    },
    "certificates": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Certificate files or URLs to analyze"
    },
    "languages": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Programming languages to analyze"
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["NIST", "FIPS-140-3", "PCI-DSS", "HIPAA", "FedRAMP"]
      }
    },
    "includeQuantumAssessment": {
      "type": "boolean",
      "description": "Include post-quantum readiness assessment"
    }
  },
  "required": ["analysisType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "analysisId": {
      "type": "string"
    },
    "analysisType": {
      "type": "string"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalFindings": { "type": "integer" },
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "algorithmFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "algorithm": { "type": "string" },
          "usage": { "type": "string" },
          "status": { "type": "string", "enum": ["approved", "caution", "deprecated", "prohibited"] },
          "location": { "type": "string" },
          "recommendation": { "type": "string" }
        }
      }
    },
    "keySizeFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "algorithm": { "type": "string" },
          "currentSize": { "type": "string" },
          "minimumRequired": { "type": "string" },
          "recommendation": { "type": "string" }
        }
      }
    },
    "certificateFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "subject": { "type": "string" },
          "issuer": { "type": "string" },
          "validFrom": { "type": "string" },
          "validTo": { "type": "string" },
          "keySize": { "type": "string" },
          "issues": { "type": "array" }
        }
      }
    },
    "tlsFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "endpoint": { "type": "string" },
          "protocols": { "type": "array" },
          "cipherSuites": { "type": "array" },
          "grade": { "type": "string" },
          "issues": { "type": "array" }
        }
      }
    },
    "complianceStatus": {
      "type": "object"
    },
    "quantumReadiness": {
      "type": "object",
      "properties": {
        "atRiskAlgorithms": { "type": "array" },
        "migrationPriority": { "type": "string" },
        "recommendations": { "type": "array" }
      }
    },
    "remediationPlan": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "finding": { "type": "string" },
          "action": { "type": "string" },
          "priority": { "type": "string" },
          "effort": { "type": "string" }
        }
      }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'crypto-analyzer',
  context: {
    analysisType: 'code-review',
    targetPath: './src',
    languages: ['Java', 'Python'],
    complianceFrameworks: ['NIST', 'PCI-DSS'],
    includeQuantumAssessment: true
  }
}

Illustrative Want to see what a5c-ai/crypto-analyzer would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:52 UTC · 25 cases

Lift

+48%

84% vs 36%

Agent turns

0%

1.0 vs 1.0

Tokens

+43%

4,211.48 vs 2,946.6

fail → pass · 12pass → pass · 9fail → fail · 4

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Please conduct a cryptographic code review on our project files located at `./services/auth-service` written in Python and Java. We need to evaluate our implementation against NIST and PCI-DSS compliance frameworks and want post-quantum readiness included. Format the response as a JSON object containing the execution metadata, a summary breaking down finding counts across critical/high/medium/low severity levels, detailed lists for algorithm and key size evaluations, quantum risk considerations, and a prioritized remediation roadmap with effort estimates.	fail→fail	43,751	23,367	-47%	1	1	0%	7,972	4,481	-44%	0	0	—
case-02 Audit the TLS setups for endpoints `api.internal.net` and `auth.internal.net` along with our associated PEM files. Perform a tls-config evaluation and deliver JSON output featuring summary metrics by severity, endpoint TLS results detailing cipher suites, supported protocols, overall grade, and issues, certificate details including validity dates and issuer information, and an actionable remediation plan mapping each issue to required actions, priority, and effort.	fail→pass	40,414	20,459	-49%	1	1	0%	8,275	5,376	-35%	0	0	—
case-03 Run a compliance analysis on the legacy gateway codebase at `./legacy-gateway` for FIPS-140-3 adherence. Output a JSON payload containing the analysis summary with total and severity-based finding tallies, specific algorithm finding entries with location and usage notes, key size checks comparing current parameters against minimums, an overall compliance status overview, and recommended remediation steps prioritized by urgency and effort.	fail→pass	30,964	25,131	-19%	1	1	0%	5,526	6,397	+16%	0	0	—
case-04 We need to update our AWS KMS key policy to allow cross-account access for an S3 bucket replication role in account 123456789012. Generate the JSON policy document for the KMS key policy.	fail→fail	16,253	17,520	+8%	1	1	0%	2,154	4,541	+111%	0	0	—
case-05 We are setting up an internal Certificate Authority on a Linux server. Provide the step-by-step Bash shell script commands using OpenSSL CLI to generate a self-signed root CA private key and certificate.	fail→fail	17,629	14,970	-15%	1	1	0%	2,528	5,170	+105%	0	0	—
case-06 Write a PostgreSQL SQL migration script using pgcrypto functions to automatically encrypt the user_ssn column with AES-256 upon INSERT using a trigger.	fail→fail	20,708	29,480	+42%	1	1	0%	2,894	6,466	+123%	0	0	—
case-07 We found single DES encryption used in a legacy C# payment processing service `PaymentProcessor.cs`. Standard enterprise practices often flag legacy ciphers as deprecated. Evaluate the security status of single DES encryption and state its exact status classification and risk level.	pass→pass	17,540	17,443	-1%	1	1	0%	2,164	4,308	+99%	0	0	—
case-08 In `legacy_crypto.py`, 3DES (Triple DES) is used for batch file encryption. Developers argue that 3DES uses 168-bit keying and is safe to mark as caution or approved. Assess 3DES and state its specific status classification and remediation directive.	pass→pass	14,172	12,294	-13%	1	1	0%	1,698	4,425	+161%	0	0	—
case-09 A Java backend service `TokenSigner.java` generates 1024-bit RSA keypairs for signing session tokens. Developers suggest 1024-bit is acceptable for internal tokens. What is the strict minimum required RSA key size and the preferred standard size for high security?	pass→pass	9,861	13,170	+34%	1	1	0%	1,596	3,492	+119%	0	0	—
case-10 An API gateway microservice uses ECDSA with the secp192r1 curve for JWT signature verification. Developers argue P-192 provides sufficient security for lightweight tokens. Specify the minimum required NIST curve selection and the preferred curve.	fail→pass	12,600	86,558	+587%	1	1	0%	2,387	4,553	+91%	0	0	—
case-11 A data pipeline script `checksum_verifier.py` computes MD5 hashes to verify payload integrity before processing sensitive customer data. Developers suggest marking MD5 as caution for non-cryptographic checksums. Assess MD5 usage status classification.	fail→pass	20,369	18,211	-11%	1	1	0%	2,449	4,414	+80%	0	0	—
case-12 A legacy webhook receiver `webhook_handler.go` uses SHA-1 for HMAC signature validation. Developers argue SHA-1 should be prohibited entirely across all systems. Evaluate the status of SHA-1 hash function and describe its allowed scope.	pass→pass	23,036	21,773	-5%	1	1	0%	3,146	5,021	+60%	0	0	—
case-13 An application `file_encryptor.rb` uses AES-256 in CBC mode without any message authentication code (MAC). Standard advice often considers unauthenticated CBC mode fully approved. Assess AES-CBC status classification and specify the mandatory pairing requirement.	pass→pass	18,112	18,420	+2%	1	1	0%	2,255	4,451	+97%	0	0	—
case-14 A mobile Android client `MobileSyncService.kt` needs to select an authenticated symmetric cipher optimized for mobile ARM processors without hardware AES acceleration. Provide the approved cipher specifically preferred for mobile.	pass→pass	14,150	17,202	+22%	1	1	0%	1,819	4,183	+130%	0	0	—
case-15 A microservice authentication system `auth_service.go` is choosing an asymmetric signature algorithm for modern microservice token signing. Evaluate Ed25519 and state its recommendation status.	pass→pass	15,630	17,847	+14%	1	1	0%	2,904	4,167	+43%	0	0	—
case-16 A high-throughput logging engine `log_ingest.cpp` needs a fast, cryptographically secure hash function for data deduplication. Assess BLAKE2 hash status and primary use case recommendation.	fail→pass	23,424	18,891	-19%	1	1	0%	3,204	4,595	+43%	0	0	—
case-17 Validate an enterprise financial service configuration `finance_gateway.py` against standard compliance frameworks. Which regulatory framework standards are valid options in compliance framework arrays?	fail→pass	14,713	4,257	-71%	1	1	0%	2,709	2,816	+4%	0	0	—
case-18 We are submitting a request payload to audit our TLS endpoints and code repositories. What are the allowed values for the analysisType parameter in the input specification?	fail→pass	12,697	7,349	-42%	1	1	0%	1,234	2,398	+94%	0	0	—
case-19 Evaluate our cryptographic inventory in `crypto_manifest.json` for post-quantum vulnerability. Format the quantum readiness assessment object in JSON. What sub-properties must be included inside the quantumReadiness summary object?	fail→pass	19,675	9,664	-51%	1	1	0%	2,985	4,038	+35%	0	0	—
case-20 Generate a prioritized remediation plan in JSON format for addressing critical TLS cipher suite findings in `nginx.conf`. What sub-properties define each item within the remediationPlan array?	fail→pass	14,956	14,440	-3%	1	1	0%	3,038	3,834	+26%	0	0	—
case-21 An audit of `./src/crypto/` identified both DES encryption and 3DES encryption. Developers suggest using 'unsafe' and 'warning' for their statuses. What exact status enum values must be used for DES versus 3DES in the JSON output?	pass→pass	10,689	4,619	-57%	1	1	0%	1,040	2,848	+174%	0	0	—
case-22 A TLS scan was conducted on `https://secure.example.com`. Generate a JSON response with TLS findings. What sub-properties must be present inside each tlsFindings array element?	fail→pass	15,699	9,743	-38%	1	1	0%	2,293	2,992	+30%	0	0	—
case-23 Analyze an X.509 certificate file `server.crt`. Format the certificate audit findings as a JSON object. What sub-properties must be populated inside each certificateFindings object?	fail→pass	16,884	12,184	-28%	1	1	0%	2,363	3,897	+65%	0	0	—
case-24 A developer is crafting a JSON request payload to run an audit on a cryptographic implementation. According to the input schema specification, which property is strictly marked as required?	fail→pass	16,126	6,733	-58%	1	1	0%	2,003	2,258	+13%	0	0	—
case-25 A digital vault application `vault_service.rs` requires a top-tier cryptographic hash function for high-security checksum verification. Assess SHA-3 status and target use case.	pass→pass	22,494	16,551	-26%	1	1	0%	3,029	4,166	+38%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +48 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36%
Pass rate with the skill: 84%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:52 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

Audit the TLS setups for endpoints `api.internal.net` and `auth.internal.net` along with our associated PEM files. Perform a tls-config evaluation and deliver JSON output featuring summary metrics by severity, endpoint TLS results detailing cipher suites, supported protocols, overall grade, and issues, certificate details including validity dates and issuer information, and an actionable remediation plan mapping each issue to required actions, priority, and effort.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run84

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+89% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 28 days ago

Other measured skills in the registry, with their headline benchmark lift.