Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Input · williamzujkowski | DecimalAI

williamzujkowski/Cryptographic Security Validator

SkillScore74Maintained

Validate cryptographic implementations using NIST standards with TLS configuration, cipher suite analysis, and certificate lifecycle checks.

Securityby williamzujkowski

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/williamzujkowski-cryptographic-security-validator/SKILL.md

decimalai skills pull williamzujkowski-cryptographic-security-validator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/williamzujkowski-cryptographic-security-validator/SKILL.md https://app.decimal.ai/s/williamzujkowski-cryptographic-security-validator/SKILL.md

Raw file: /s/williamzujkowski-cryptographic-security-validator/SKILL.md ↗ · machine-readable summary at /s/williamzujkowski-cryptographic-security-validator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 51d ago

Yes — +57% lift · at higher cost+86% tokens0% turns74% of whole cases pass with skill (17/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	99%	0%
case-06	✗→✓	▲ Improved	99%	0%
case-08	✗→✓	▲ Improved	479%	0%
case-09	✗→✓	▲ Improved	114%	0%
case-10	✗→✓	▲ Improved	39%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/2/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

williamzujkowski / cognitive-toolworks

skills/security-crypto-validator/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

Purpose & When-To-Use

Trigger conditions:

Cryptographic implementation review before production deployment
TLS/SSL configuration audit
Certificate lifecycle management validation
FIPS 140-2/3 compliance requirement
Post-incident cryptographic security assessment

Not for:

Cryptographic algorithm design (use research/academic resources)
Quantum-resistant cryptography evaluation (requires specialized analysis)
Application-level encryption implementation (use security-appsec-validator)
Physical HSM security assessment (requires on-site evaluation)

Pre-Checks

Time normalization:

Compute NOW_ET using NIST/time.gov semantics (America/New_York, ISO-8601): 2025-10-26T01:33:55-04:00
Use NOW_ET for all citation access dates

Input validation:

target_system must be non-empty string
crypto_scope must be one of: tls, certificates, key-management, all]
compliance_standard must be one of: nist, fips, pci-dss, none]

Source freshness:

NIST SP 800-52 Rev 2 - TLS Guidelines (accessed 2025-10-26T01:33:55-04:00): https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final
NIST SP 800-175B - Key Management (accessed 2025-10-26T01:33:55-04:00): https://csrc.nist.gov/publications/detail/sp/800-175b/final
FIPS 140-2/3 Standards (accessed 2025-10-26T01:33:55-04:00): https://csrc.nist.gov/projects/cryptographic-module-validation-program

Procedure

Step 1: Critical Cryptographic Controls Check

TLS Configuration:

TLS 1.2 or higher enforced (TLS 1.0/1.1 disabled)
Strong cipher suites only (per NIST SP 800-52 Rev 2, accessed 2025-10-26T01:33:55-04:00)

Prohibited: RC4, DES, 3DES, MD5, SHA-1 for signatures
Required: AES-GCM, ChaCha20-Poly1305, ECDHE/DHE key exchange

Perfect Forward Secrecy (PFS) enabled
Secure renegotiation configured

Certificate Management:

Certificate validity (not expired, not self-signed for production)
Certificate chain completeness
Certificate revocation checking (OCSP or CRL)
Key strength (RSA ≥2048-bit, ECC ≥256-bit)
Certificate rotation process exists

Key Management:

Key rotation mechanism present (90-day max for high-security)
Keys stored in HSM or secure key management service
No hardcoded keys in code or configuration
Separate keys for encryption vs signing

Step 2: Generate NIST-Aligned Remediation

For each finding, provide:

NIST SP 800-52/175B control reference
TLS/cipher configuration snippets (Apache, Nginx, IIS, etc.)
Certificate management procedures

Token budgets:

T1: ≤2k tokens (critical TLS/certificate findings)
T2: ≤6k tokens (full cryptographic audit with NIST compliance)
T3: Not applicable for this skill (use security-auditor agent for comprehensive assessments)

Decision Rules

Ambiguity thresholds:

If TLS configuration unavailable → request server config files or scan results
If certificate details missing → request certificate chain PEM files

Abort conditions:

No target system specified → cannot proceed
No TLS endpoints or certificates found → verify system has encrypted communications

Severity classification:

Critical: Weak ciphers (RC4, DES), expired certificates (CVSS 9.0-10.0)
High: TLS 1.0/1.1 enabled, missing PFS (CVSS 7.0-8.9)
Medium: Certificate rotation gaps, weak key sizes (CVSS 4.0-6.9)
Low: OCSP stapling missing, cipher ordering (CVSS 0.1-3.9)

Output Contract

Required fields:

json
{
  "target_system": "string",
  "crypto_scope": "tls|certificates|key-management|all",
  "compliance_standard": "nist|fips|pci-dss|none",
  "timestamp": "ISO-8601 with timezone",
  "findings": [
    {
      "id": "unique identifier",
      "category": "tls|certificate|key-management",
      "severity": "critical|high|medium|low",
      "cvss_score": 0.0,
      "title": "brief description",
      "description": "detailed finding",
      "nist_reference": "SP 800-52 Rev 2 section X.Y",
      "affected_endpoints": ["URLs or service names"],
      "remediation": "specific fix steps",
      "remediation_config": "configuration snippet"
    }
  ],
  "compliance_status": {
    "standard": "nist|fips|pci-dss",
    "controls_assessed": ["list"],
    "controls_passed": ["list"],
    "controls_failed": ["list"]
  },
  "summary": {
    "total_findings": 0,
    "critical_count": 0,
    "high_count": 0,
    "overall_risk": "critical|high|medium|low"
  }
}

Examples

Example: TLS Configuration Check

yaml
# Input
target_system: "api.example.com"
crypto_scope: "tls"
compliance_standard: "nist"

# Output (abbreviated)
{
  "target_system": "api.example.com",
  "findings": [
    {
      "id": "CRYPTO-001",
      "category": "tls",
      "severity": "high",
      "cvss_score": 7.4,
      "title": "TLS 1.1 enabled (deprecated protocol)",
      "nist_reference": "SP 800-52 Rev 2 Section 3.1",
      "remediation_config": "SSLProtocol -all +TLSv1.2 +TLSv1.3"
    }
  ],
  "summary": {"high_count": 1, "overall_risk": "high"}
}

Quality Gates

Token budgets:

T1 ≤2k tokens (critical TLS/certificate findings)
T2 ≤6k tokens (full cryptographic audit with NIST compliance)

Safety:

No private keys in examples or remediation
No actual certificate details

Auditability:

Findings cite NIST SP 800-52/175B references
Cipher recommendations align with current NIST guidance

Determinism:

Same TLS/certificate state + inputs = consistent findings

Resources

NIST Standards:

NIST SP 800-52 Rev 2 (TLS Guidelines): https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final (accessed 2025-10-26T01:33:55-04:00)
NIST SP 800-175B (Key Management): https://csrc.nist.gov/publications/detail/sp/800-175b/final (accessed 2025-10-26T01:33:55-04:00)
FIPS 140-2/3 Standards: https://csrc.nist.gov/projects/cryptographic-module-validation-program (accessed 2025-10-26T01:33:55-04:00)

TLS Configuration Guides:

Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/ (accessed 2025-10-26T01:33:55-04:00)
OWASP TLS Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html (accessed 2025-10-26T01:33:55-04:00)

Certificate Management:

CA/Browser Forum Baseline Requirements: https://cabforum.org/baseline-requirements-documents/ (accessed 2025-10-26T01:33:55-04:00)

Illustrative Want to see what williamzujkowski/Cryptographic Security Validator would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/8/2026, 00:42 UTC · 23 cases

Lift

+57%

74% vs 17%

Agent turns

0%

1.0 vs 1.0

Tokens

+86%

4,586.04 vs 2,464.91

fail → pass · 14pass → pass · 3fail → fail · 5pass → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Please perform a pre-deployment cryptographic review for our web application backend service at `gateway.payments.internal`. We want to focus specifically on our TLS setup evaluated against the NIST standard. Format your output strictly as a JSON object containing top-level keys for target_system, crypto_scope, compliance_standard, timestamp, findings (an array where each item provides id, category, severity, cvss_score, title, description, nist_reference, affected_endpoints, remediation, and remediation_config), compliance_status (including standard, controls_assessed, controls_passed, and controls_failed), and summary (with total_findings, critical_count, high_count, and overall_risk).	fail→pass	12,127	13,073	+8%	1	1	0%	2,801	5,576	+99%	0	0	—
case-02 We need a security evaluation of our authentication service `auth.enterprise.net` covering key management and certificate configurations prior to a FIPS audit. Run the assessment and provide the results in a JSON structure containing target_system, crypto_scope, compliance_standard, timestamp, findings array (with id, category, severity, cvss_score, title, description, nist_reference, affected_endpoints, remediation, remediation_config), compliance_status breakdown (standard, controls_assessed, controls_passed, controls_failed), and a summary section (total_findings, critical_count, high_count, overall_risk).	fail→fail	10,178	7,369	-28%	1	1	0%	1,108	2,971	+168%	0	0	—
case-03 Following a recent security alert, please run a comprehensive cryptographic health check on `legacy-vault.service.internal` auditing all cryptographic aspects against PCI-DSS standards. Format the resulting report strictly as JSON adhering to our schema: target_system, crypto_scope, compliance_standard, timestamp, findings (with id, category, severity, cvss_score, title, description, nist_reference, affected_endpoints, remediation, remediation_config), compliance_status (standard, controls_assessed, controls_passed, controls_failed), and summary (total_findings, critical_count, high_count, overall_risk).	fail→fail	9,571	9,894	+3%	1	1	0%	1,022	3,335	+226%	0	0	—
case-04 We are designing a user database table for `user-service.prod` and want to write Python code using cryptography.fernet to encrypt user social security numbers at the application layer before storing them in Postgres. Please write the application Python implementation for column field-level encryption.	pass→fail	16,453	17,492	+6%	1	1	0%	3,389	5,768	+70%	0	0	—
case-05 Our research group is selecting a post-quantum key encapsulation mechanism to replace RSA in our custom network protocol, comparing Kyber/ML-KEM against FrodoKEM. Evaluate the mathematical lattice security bounds and quantum-resistance parameters for these candidate algorithms.	fail→fail	22,426	23,581	+5%	1	1	0%	4,242	6,776	+60%	0	0	—
case-06 Our team needs an assessment of the physical tamper-detection mechanisms, mesh wiring, and environmental zeroization triggers for an On-Prem Hardware Security Module appliance located in rack 4B.	fail→pass	25,132	22,889	-9%	1	1	0%	1,991	3,961	+99%	0	0	—
case-07 Please run a TLS cryptographic security audit using NIST standards, but I do not have a target hostname or system name yet—just review general TLS principles. Output in JSON schema with target_system, crypto_scope, compliance_standard, timestamp, findings, compliance_status, and summary.	fail→fail	13,347	12,153	-9%	1	1	0%	2,927	4,967	+70%	0	0	—
case-08 Audit the SSL and TLS transport encryption settings for target server `edge-lb.company.org` against NIST standards. Provide output in JSON schema format (target_system, crypto_scope, compliance_standard, timestamp, findings, compliance_status, summary), using standard scope mappings.	fail→pass	7,929	15,214	+92%	1	1	0%	775	4,490	+479%	0	0	—
case-09 Evaluate target system `legacy-api.bank.com` on TLS configuration against NIST standards. The server scan reveals RC4 and 3DES cipher suites enabled, TLS 1.2 present, and RSA 2048-bit certificate. Format as JSON with target_system, crypto_scope, compliance_standard, timestamp, findings, compliance_status, and summary.	fail→pass	8,535	10,466	+23%	1	1	0%	2,117	4,521	+114%	0	0	—
case-10 Perform a TLS audit on target system `portal.corp.com` using PCI-DSS standards. Scan shows TLS 1.0 and TLS 1.1 enabled alongside TLS 1.2, but all cipher suites use AES-GCM and ECDHE. Output strictly in the specified JSON schema.	fail→pass	11,768	7,162	-39%	1	1	0%	2,760	3,827	+39%	0	0	—
case-11 Audit target system `mail.partner.org` on certificate and key management against NIST SP 800-175B. The server utilizes an RSA 1024-bit server key with an active certificate. Provide output as JSON per schema.	fail→fail	6,946	11,363	+64%	1	1	0%	1,544	4,690	+204%	0	0	—
case-12 Conduct a TLS audit on `shop.vendor.com` against NIST guidelines. The server supports TLS 1.2 and 1.3 with strong cipher suites (AES-GCM, ECDHE) and 3072-bit RSA certificates, but OCSP stapling is disabled. Format strictly as JSON schema.	fail→pass	12,490	10,117	-19%	1	1	0%	3,079	4,446	+44%	0	0	—
case-13 Review key management procedures for target system `vault.internal.net` against NIST standards. The current key rotation policy requires symmetric master keys to be rotated every 180 days. Output strictly as JSON per the cryptographic review schema.	fail→pass	11,479	12,903	+12%	1	1	0%	2,425	4,960	+105%	0	0	—
case-14 Audit key management for target server `identity-provider.internal` under FIPS compliance standards. The application reuses the exact same RSA 4096 key pair for both signing SAML assertions and encrypting data at rest. Output in JSON format per schema.	fail→pass	19,304	16,044	-17%	1	1	0%	2,322	4,287	+85%	0	0	—
case-15 Run a TLS review on `web-edge.site.net` under NIST standard. The system is running Nginx and currently allows deprecated TLS protocols. Generate the audit report in JSON schema, ensuring remediation includes appropriate web server configuration snippets.	fail→pass	15,674	11,422	-27%	1	1	0%	3,718	5,160	+39%	0	0	—
case-16 Review `app.partner-portal.com` for TLS compliance under NIST guidelines. No TLS server configuration or port scan details have been provided yet. Return JSON per schema.	pass→pass	9,300	11,749	+26%	1	1	0%	1,886	4,658	+147%	0	0	—
case-17 Evaluate only the certificate lifecycle, chain completeness, and revocation mechanisms for target `secure-gateway.corp` against PCI-DSS standards. Provide output strictly in JSON schema.	fail→pass	12,957	12,613	-3%	1	1	0%	2,652	4,837	+82%	0	0	—
case-18 Audit strictly the key management controls (storage in HSM, key separation, rotation) for target `crypto-hsm.internal` against FIPS standard. Format response in JSON schema.	fail→pass	17,092	10,953	-36%	1	1	0%	3,677	4,255	+16%	0	0	—
case-19 Run a general cryptographic review for target `service.dev.local` across all scopes without enforcing a specific external compliance standard. Format output strictly as JSON schema.	fail→pass	16,181	11,937	-26%	1	1	0%	3,182	4,952	+56%	0	0	—
case-20 Perform a cryptographic audit on `auth-server.domain.com` against NIST SP 800-52 Rev 2. The certificate chain uses SHA-1 signature algorithms for intermediate CAs. Produce JSON output per schema.	pass→pass	12,748	9,004	-29%	1	1	0%	2,836	4,108	+45%	0	0	—
case-21 Audit target system `payment-gateway.store.com` for crypto issues under PCI-DSS standards. The review identifies 1 critical finding (RC4 enabled) and 1 high finding (TLS 1.0 enabled). Format as JSON adhering to schema.	fail→pass	7,961	8,745	+10%	1	1	0%	1,641	4,255	+159%	0	0	—
case-22 Conduct a cryptographic assessment on target `api-v1.enterprise.io` using NIST standards. The SSL certificate expired 3 days ago. Return response formatted strictly as JSON per schema.	fail→pass	10,910	8,878	-19%	1	1	0%	2,010	4,078	+103%	0	0	—
case-23 Review TLS configuration for target system `internal-api.service.net` under NIST SP 800-52 Rev 2 standards. The server only supports static RSA key exchange without Perfect Forward Secrecy. Provide JSON report with appropriate cipher suite remediation recommendations.	pass→pass	11,729	9,231	-21%	1	1	0%	2,589	4,601	+78%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +57 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 17.4%
Pass rate with the skill: 73.9%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/8/2026, 00:42 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

Please perform a pre-deployment cryptographic review for our web application backend service at `gateway.payments.internal`. We want to focus specifically on our TLS setup evaluated against the NIST standard. Format your output strictly as a JSON object containing top-level keys for target_system, crypto_scope, compliance_standard, timestamp, findings (an array where each item provides id, category, severity, cvss_score, title, description, nist_reference, affected_endpoints, remediation, and remediation_config), compliance_status (including standard, controls_assessed, controls_passed, and controls_failed), and summary (with total_findings, critical_count, high_count, and overall_risk).

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run74

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+83% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 50 days ago

Other measured skills in the registry, with their headline benchmark lift.