Crypto Audit

This skill performs static code analysis for cryptographic vulnerabilities across JavaScript/TypeScript, Python, Go, Java, and Rust projects. It identifies 12 common crypto anti-patterns — weak algorithms, hardcoded keys, insecure randomness, insufficient key sizes, and more — mapping each finding to CWE and OWASP Top 10:2021 standards with concrete UNSAFE/SAFE code pairs for remediation.

When to Use

• When the user asks to "audit crypto", "review cryptographic code", or "check for weak encryption"
• When the user mentions "crypto audit", "cryptographic review", or "insecure crypto"
• When scanning code that imports cryptographic libraries (e.g., crypto, hashlib, javax.crypto, crypto/tls)
• When reviewing code for compliance with cryptographic standards (FIPS, PCI-DSS)
• When a pull request modifies encryption, hashing, TLS configuration, or key management code
• When the user asks about "hardcoded keys", "weak hashing", "insecure random", or "deprecated TLS"

When NOT to Use