crypto-library-misuse
Detects library-internal cryptographic correctness bugs that pattern matchers and crypto-failures skills miss — AEAD nonce reuse, ECDSA k-value reuse, length-extension on bare hashes, padding-oracle exception distinguishability, and branching on secret material. Use when writing code that calls a crypto primitive directly (AEAD encrypt/decrypt, ECDSA/DSA sign, raw hash, RSA decrypt). Distinct from cryptographic-failures, which covers application-layer choices like MD5 for passwords; this skill is about how primitives are wired up.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/crypto-library-misuse" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/crypto-library-misuse ~/.claude/skills/crypto-library-misuseFrom README
Crypto Library Misuse (CWE-323, CWE-330, CWE-208) What this checks Cryptographic primitives are correct only when their preconditions are met. Not "weak algorithm picked" — that's cryptographic-failures. These are "right primitive, wrong wiring": nonce reused, per-signature random reused, comparison branches on secret bits, exception type leaks which decryption failure happened. Each pattern below has produced a real CVE (Sony PS3 ECDSA k-reuse, Marvin RSA timing). Vulnerable patterns AEAD nonce reuse: an AEAD encrypt call where the nonce is fixed, zeroed, or a wrapping counter. A single reused nonce lets an attacker XOR two ciphertexts and recover both plaintexts. ECDSA/DSA k reuse or weak randomness: signing with a predictable or repeated per-signature random value. Two signatures with the same k recover the private key by linear algebra. Length-extension on bare hashes: using hash(secret || msg) as a MAC.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...