# cryptographic-failures

> Claude/Codex skill by [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars · Updated 2026-07-31

Detects weak or broken cryptography that lets attackers recover plaintext passwords, forge tokens, or decrypt sensitive data. Use when writing code that encrypts or decrypts data, hashes passwords or tokens, generates random values for security purposes, manages cryptographic keys, or configures TLS/SSL settings. Also invoke when storing sensitive data at rest.

Tags: llms, security, skills

## Install

```sh
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/cryptographic-failures ~/.claude/skills/cryptographic-failures
```

## From README

Cryptographic Failures Security Check (A04:2025) What this checks Protects against weak or broken cryptography that allows attackers to recover plaintext passwords, forge tokens, or decrypt sensitive data. Failures here directly enable credential stuffing, account takeover, and data breach. Vulnerable patterns Password hashed with a fast or unsalted algorithm such as MD5, SHA1, or bare SHA-256 Security-sensitive token, session ID, nonce, or key generated from a non-cryptographic PRNG Encryption or signing key declared as a hardcoded string in source Symmetric encryption using ECB mode, or CBC mode with no separate MAC A nonce or IV that is constant, zero, or reused across messages with the same key Fix immediately Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties: Passwords go through a slow, salted, memory-hard hash — bcrypt, scrypt, or argon2.

## Links

- HTML page: https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/cryptographic-failures/
- GitHub: https://github.com/thejefflarson/soundcheck
- Author: [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md)

## More from this repo

- [authentication-failures](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/authentication-failures/index.md) — Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [broken-access-control](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/broken-access-control/index.md) — Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars
- [concurrency-correctness](https://omgskills.com/library/thejefflarson/soundcheck/dot-claude/skills/concurrency-correctness/index.md) — Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...
   - [@thejefflarson](https://omgskills.com/library/thejefflarson/index.md) · 20 stars