From soundcheck
Detects cryptographic failures in code: weak hashes (MD5), insecure randomness (Math.random/random), hardcoded keys/secrets, ECB mode. Recommends bcrypt/argon2, CSPRNGs (secrets/crypto.randomBytes), env vars, AES-GCM.
npx claudepluginhub thejefflarson/soundcheck --plugin soundcheckThis skill uses the workspace's default tool permissions.
Protects against weak or broken cryptography that allows attackers to recover
Detects cryptographic failures like weak hashing (MD5/SHA1), hardcoded secrets, insecure randomness in Python, Java, Go, PHP, TypeScript code using grep patterns for whitebox pentesting.
Guides secure cryptography: hashing (Argon2id, bcrypt), encryption (AES-256-GCM), key management, JWT signing, TLS hardening, digital signatures for sensitive data.
Analyzes PHP code for cryptography vulnerabilities like weak algorithms, hardcoded keys, insecure random, poor key management, and deprecated functions. Ideal for PHP security audits.
Share bugs, ideas, or general feedback.
Protects against weak or broken cryptography that allows attackers to recover plaintext passwords, forge tokens, or decrypt sensitive data. Failures here directly enable credential stuffing, account takeover, and data breach.
hashlib.md5(password.encode()).hexdigest() — MD5 is broken; no salt, trivially reversed with rainbow tablestoken = str(random.random()) — Math.random() / random is not cryptographically secureSECRET_KEY = "hardcoded-secret" — key committed to source controlAES.new(key, AES.MODE_ECB) — ECB mode leaks patterns; identical plaintext blocks produce identical ciphertextFlag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
secrets in Python,
crypto.randomBytes in Node, crypto/rand in Go, SecureRandom in Java.
Never random, Math.random, or time-seeded PRNGs for tokens, session IDs,
nonces, or keys.Anchor — shape, not implementation:
hashed = password_hash(password, algo=bcrypt_or_argon2) # slow + salted
token = csprng_bytes(32) # not Math.random
key = load_from_env_or_kms("ENCRYPTION_KEY")
ct = aead_encrypt(key, nonce=csprng_bytes(12), pt, aad)
Confirm the response:
secrets.token_urlsafe / crypto.randomBytes — not random / Math.random()