cryptographic-failures
Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also invoke when storing sensitive data at rest.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/cryptographic-failures" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/cryptographic-failures ~/.claude/skills/cryptographic-failuresFrom README
Cryptographic Failures Security Check (A04:2025) What this checks Protects against weak or broken cryptography that allows attackers to recover plaintext passwords, forge tokens, or decrypt sensitive data. Failures here directly enable credential stuffing, account takeover, and data breach. Vulnerable patterns Password hashed with a fast or unsalted algorithm such as MD5, SHA1, or bare SHA-256 Security-sensitive token, session ID, nonce, or key generated from a non-cryptographic PRNG Encryption or signing key declared as a hardcoded string in source Symmetric encryption using ECB mode, or CBC mode with no separate MAC A nonce or IV that is constant, zero, or reused across messages with the same key Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Passwords go through a slow, salted, memory-hard hash — bcrypt, scrypt, or argon2.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...