Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
Crypto-misuse review — non-constant-time comparison of secrets (timing side-channels), missing/compiler-elidable zeroization of secrets, and non-cryptographic RNG used to mint secrets. The crypto-reviewer agent confirms each candidate handles a secret and promotes real issues into .kuzushi/findings.json (source "crypto-review"). Distinct from /sast (injection) and /sharp-edges (API design).
npx claudepluginhub allsmog/kuzushi-security-plugin --plugin kuzushi-security-pluginHow this skill is triggered — by the user, by Claude, or both
Slash command
/kuzushi-security-plugin:crypto-reviewcrypto-reviewerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Find the crypto-implementation footguns that look fine but leak or weaken secrets.
Searches USPTO patent and trademark records from official APIs including PatentSearch, TSDR, and assignment databases.
Share bugs, ideas, or general feedback.
Find the crypto-implementation footguns that look fine but leak or weaken secrets.
node "${CLAUDE_PLUGIN_ROOT}/scripts/cmd/crypto-review-prepare.mjs" --target "<repo root>"
(optionally --input '{"maxCandidates":30}'). If it reports no-candidates, say so and stop.
Read the prep's prepPath.memset), or weak-crypto-rng (non-CSPRNG minting a
token/key/nonce). Decide finding / candidate / rejected.{ candidates: [...] } bundle to the prep's draftPath, then run the
assembleCommand — it validates verdicts/categories and promotes them into
.kuzushi/findings.json (source:"crypto-review")./sast, /taint-analysis, and /sharp-edges.memset on a dying buffer is often optimized away; only a secure-zero
primitive counts.Math.random/rand() are predictable; for secrets that's a finding.