Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-weak-cryptography
Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false).
Passed 19 of 22 test cases with the skill, and 14 of 22 without it.
and 2 more in the full report
5 fixed15 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our repository at `/workspace/build-cache` uses MD5 solely to hash build artifact keys for deduplication, causing false positive findings during our automated security checks. Which exact command-line option should we pass to our local scanner script `scan_weak_crypto.py` to suppress MD5 flags on non-security checksums?
| Checked | Without skill | With skill |
|---|---|---|
| Includes the --allow-md5-checksums option | Missed | Passed |
The instructions your model reads when the skill loads.
Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic
Algorithm, CWE-330 Use of Insufficiently Random Values) shows up
when engineers use the convenient API instead of the cryptographic
one. hashlib.md5(password) is faster to type than the correct
bcrypt/argon2 invocation; Math.random() returns a number quickly
without needing to know about crypto.randomBytes().
The fix is universal: use the modern primitive. SHA-256 for general
hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption,
HMAC-SHA256 for signing, secrets / crypto.randomBytes /
SecureRandom for randomness.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
| MD5 used in security context | HIGH | hashlib.md5, MessageDigest.MD5, CryptoJS.MD5 | CWE-327 |
| SHA-1 used in security context | HIGH | hashlib.sha1, etc. | CWE-327 |
| DES / 3DES cipher | CRITICAL | DESCrypto, "DES/CBC", "DESede" | CWE-327 |
| RC4 cipher | CRITICAL | "ARC4", "RC4" | CWE-327 |
| AES ECB mode | CRITICAL | "AES/ECB" or MODE_ECB | CWE-327 |
| Hardcoded IV (initialization vector) | CRITICAL | IV literal in source | CWE-329 |
| Custom XOR-based "encryption" | CRITICAL | XOR loop over bytes | CWE-327 |
| Predictable random for crypto seed | CRITICAL | Math.random / java.util.Random / random.random for keys | CWE-330 |
| TLS cert verification disabled | CRITICAL | verify=False, rejectUnauthorized:false, ServerCertificateValidationCallback returning true | CWE-295 |
| Hardcoded HMAC secret | HIGH | Long literal in HMAC constructor | CWE-321 |
| Insecure password hashing (no salt, no KDF) | CRITICAL | hashlib.sha256(password) without bcrypt/argon2 | CWE-916 |
test cases passed, vs 14 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.