Agent skill · security · jeremylongshore
detecting-weak-cryptography
Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token signing." Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: "scan weak crypto", "find MD5 usage", "check ECB mode", "audit ssl verify", "weak random".
Why this skill is useful
Adds a script that scans for weak cryptographic practices and provides remediation guidance, which the AI cannot generate on its own.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Weak Cryptography Overview Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic Algorithm, CWE-330 Use of Insufficiently Random Values) shows up when engineers use the convenient API instead of the cryptographic one. hashlib.md5(password) is faster to type than the correct bcrypt/argon2 invocation; Math.random() returns a number quickly without needing to know about crypto.randomBytes(). The fix is universal: use the modern primitive. SHA-256 for general hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption, HMAC-SHA256 for signing, secrets / crypto.randomBytes / SecureRandom for randomness. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- MD5 used in security context HIGH hashlib.md5, MessageDigest.MD5, CryptoJS.MD5 CWE-327 SHA-1 used in security context HIGH hashlib.sha1, etc. CWE-327 DES / 3DES cipher CRITICAL DESCrypto, "DES/CBC", "DESede" CWE-327 RC4 cipher CRITICAL "ARC4", "RC4" CWE-327 AES ECB mode CRITICAL "AES/ECB" or MODEECB CWE-327 Hardcoded IV (initialization vector) CRITICAL IV literal in source CWE-329 Custom XOR-based "encryption" CRITICAL XOR loop over bytes CWE-327 Predictable random for crypto seed CRITICAL Math.random / java.util.Random / random.random for keys CWE-330 TLS cert verification disabled CRITICAL verify=False, rejectUnauthorized:false, ServerCertificateValidationCallback returning true CWE-295 Hardcoded HMAC secret HIGH Long literal in HMAC constructor CWE-321 Insecure password hashing (no salt, no KDF) CRITICAL hashlib.sha256(password) without bcrypt/argon2 CWE-916 Prerequisites Python 3.9+ Source tree on local filesystem Instructions Run Options: --output, --format, --min-severity, --include-tests, --languages, --allow-md5-checksums (excludes MD5 used in non-security contexts like content-addressable storage). Interpret CRITICAL = direct cryptographic break available against the algorithm. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-weak-cryptography--e201cb