Agent skill · security · sickn33
constant-time-analysis
Analyze cryptographic code to detect operations that leak secret data through execution timing variations.
Why this skill is useful
Adds a Python script for analyzing cryptographic code for timing attacks, which is not commonly known or available in public documentation.
What it needs
Requires uv installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
Bundled upstream support Supporting files are included at skill-relative paths. See UPSTREAM-NOTICE.md for their pinned sources, licenses, hashes, and import changes. Constant-Time Analysis Analyze cryptographic code to detect operations that leak secret data through execution timing variations. When to Use Concrete triggers: User implements signature, encryption, or key derivation Code contains / or % operators on secret-derived values User mentions "constant-time", "timing attack", "side-channel", "KyberSlash" Reviewing functions named sign, verify, encrypt, decrypt, derivekey When NOT to Use Non-cryptographic code (business logic, UI, etc.) Public data processing where timing leaks don't matter Code that doesn't handle secrets, keys, or authentication tokens High-level API usage where timing is handled by the library Language Selection Based on the file extension or language context, refer to the appropriate guide: Language File Extensions Guide ---------- --------------------------------- -------------------------------------------------------- C, C++ .c, .h, .cpp, .cc, .hpp references/compiled.md Go .go references/compiled.md Rust .rs references/compiled.md Swift .swift references/swift.md Java .java references/vm-compiled.md Kotlin .kt, .kts references/kotlin.md C# .cs references/vm-compiled.md PHP .php references/php.md JavaScript .js, .mjs, .cjs references/javascript.md TypeScript .ts, .tsx references/javascript.md Python .py references/python.md Ruby .rb references/ruby.md Quick Start Native Compiled Languages Only (C, C++, Go, Rust) VM-Compiled Languages (Java, Kotlin, C#) Note: Java, Kotlin, and C# compile to bytecode (JVM/CIL) that runs on a virtual machine with JIT compilation. The analyzer examines the bytecode directly, not the JIT-compiled native code. The --arch and --opt-level flags do not apply to these languages. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/constant-time-analysis--fc26ea