{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-detecting-wea-42be73",
  "kind": "skill",
  "name": "detecting-weak-cryptography",
  "description": "Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when \"we found a weakness in our token signing.\" Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: \"scan weak crypto\", \"find MD5 usage\", \"check ECB mode\", \"audit ssl verify\", \"weak random\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding",
      "math"
    ],
    "tags": [
      "skill-md",
      "security",
      "static-analysis",
      "cryptography",
      "pentest",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when \"we found a weakness in our token signing.\" Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: \"scan weak crypto\", \"find MD5 usage\", \"check ECB mode\", \"audit ssl verify\", \"weak random\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "plugins/security/penetration-tester/skills/detecting-weak-cryptography/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/plugins/security/penetration-tester/skills/detecting-weak-cryptography/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/plugins/security/penetration-tester/skills/detecting-weak-cryptography/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read",
      "Bash(python3:*)",
      "Glob",
      "Grep"
    ],
    "license": "MIT"
  },
  "instructions": "# Detecting Weak Cryptography\n\n## Overview\n\nWeak cryptography (CWE-327 Use of a Broken or Risky Cryptographic\nAlgorithm, CWE-330 Use of Insufficiently Random Values) shows up\nwhen engineers use the convenient API instead of the cryptographic\none. `hashlib.md5(password)` is faster to type than the correct\nbcrypt/argon2 invocation; `Math.random()` returns a number quickly\nwithout needing to know about `crypto.randomBytes()`.\n\nThe fix is universal: use the modern primitive. SHA-256 for general\nhashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption,\nHMAC-SHA256 for signing, `secrets` ",
  "cost": {
    "context_tokens": 1028
  }
}