From agentic-security
Prevents writing cryptographically broken primitives (MD5/SHA1 for passwords, DES/RC4, static IVs). Refuses edits and proposes secure alternatives like bcrypt, AES-GCM, and proper JWT verification.
How this skill is triggered — by the user, by Claude, or both
Slash command
/agentic-security:security-weak-cryptoThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Activates **before** you write code that uses a cryptographically broken
Activates before you write code that uses a cryptographically broken primitive. This is a "stop before the damage" skill — not a post-hoc warning. By the time the scanner flags it, the code is already on disk.
You're about to call Edit / Write with a body that contains any of:
crypto.createHash('md5'|'sha1'|'sha256') followed by update(password),
hashlib.md5(password), MessageDigest.getInstance("MD5"), etc.crypto.createCipheriv('des'|'des-ede3'|'rc4', …), Cipher.getInstance("DES"),
from Crypto.Cipher import DES.Buffer.alloc(16), hardcoded Buffer.from('00000…'),
bytes(16) in Python, etc.none algorithm or no signature verification.Stop. Refuse the edit. Propose the right primitive.
bcrypt, scrypt, argon2. Show the import.crypto.randomBytes(32).toString('hex') (Node),
secrets.token_urlsafe(32) (Python).algorithms: ['RS256'] (or HS256 with a
long secret), jwt.verify(...) not jwt.decode(...)./fix if the file is already saved. If the user already
pushed it, route to /fix --one <id> after a scan picks it up./setup --bodyguard — make this skill mandatory on every Edit/Write/scan --secrets — pick up weak-crypto findings the bodyguard missed/fix --one <id> — close any md5/sha1-password finding already flaggednpx claudepluginhub clear-capabilities/agentic-security --plugin agentic-securityDetects weak or broken cryptography: weak password hashing, non-cryptographic PRNG for tokens, hardcoded keys, and insecure encryption modes.
Detects cryptographic failures like weak hashing (MD5/SHA1), hardcoded secrets, insecure randomness in Python, Java, Go, PHP, TypeScript code using grep patterns for whitebox pentesting.
Guides secure cryptography: hashing (Argon2id, bcrypt), encryption (AES-256-GCM), key management, JWT signing, TLS hardening, digital signatures for sensitive data.