crypt

Designing cryptographic architecture: algorithm selection, key management, E2EE, KMS integration, signature verification, and TLS configuration. Use when designing cryptographic protocols, key rotation flows, or end-to-end encryption architectures.

Aller à l'installation

Dépôt: simota/agent-skills
Dernière activité de la source: 29 juillet 2026 à 03:21
Langue détectée de SKILL.md: anglais
Étoiles: 71
Forks: 14

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/simota/agent-skills --skill crypt

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

8 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

chain

Auditing skill/plugin/MCP supply chains. Treats SKILL.md, bundled scripts, MCP server defs, hooks, and `.claude/` config as third-party software. Generates sha256 manifests, scans for Unicode Tag injection, detects curl-pipe + credential-exfil patterns, enforces third-party intake checklist, and pins MCP tool descriptions against rug-pulls. Use when auditing skill/MCP supply chain. Not for app SAST (Sentinel), CI/CD (Gear/Pipe), hook design (Latch), SKILL.md format (Gauge), or runtime exploit (Probe).

2026-08-10

latch

Proposing, configuring, debugging, and maintaining Claude Code hooks (PreToolUse/PostToolUse/Stop and other lifecycle events). Use when workflow automation, quality gates, or security enforcement via hooks is needed.

2026-08-10

nexus

Orchestrating specialist AI agent teams as a meta-coordinator. Decomposes requests into minimum viable chains, spawns each as an independent session in AUTORUN modes, and drives to final output. Use when a task spans multiple specialist domains, requires parallel agent execution, or needs hub-and-spoke routing across the skill ecosystem.

2026-08-10

Tout voir dans ce dépôt

Crypt

Design cryptographic architectures. Crypt turns security requirements into algorithm selections, key management designs, E2EE schemes, signature systems, and TLS configurations with anti-pattern detection and post-quantum readiness.

Trigger Guidance

Use Crypt when the user needs:

a cryptographic algorithm selected for a use case

key management or KMS integration designed

end-to-end encryption (E2EE) architecture designed

JWT/JWE/JWS or digital signature scheme designed

password hashing strategy selected and tuned

TLS/mTLS configuration designed

cryptographic anti-patterns detected and fixed

post-quantum cryptography migration planned

CNSA 2.0 compliance assessed for national security systems

iOS Keychain (kSecAttrAccessControl / biometry-gated) + Secure Enclave (kSecAttrTokenIDSecureEnclave) key custody designed

Android Keystore + StrongBox Keymaster (setIsStrongBoxBacked(true)) key custody designed

mobile JWT lifetime + refresh-token rotation defaults selected (access 15-60 min, refresh 30-90 days + rotation per 2025 standards)

first-party-only certificate pinning with backup public keys designed for high-risk mobile apps

Passkey / WebAuthn / FIDO2 server-side validation and signature-counter handling designed

Route elsewhere when the task is primarily:

static code security scanning: Sentinel

dynamic security testing: Probe

privacy engineering or PII handling:

Crypt

Trigger Guidance

Use Crypt when the user needs:

a cryptographic algorithm selected for a use case

key management or KMS integration designed

end-to-end encryption (E2EE) architecture designed

JWT/JWE/JWS or digital signature scheme designed

password hashing strategy selected and tuned

TLS/mTLS configuration designed

cryptographic anti-patterns detected and fixed

post-quantum cryptography migration planned

CNSA 2.0 compliance assessed for national security systems

iOS Keychain (kSecAttrAccessControl / biometry-gated) + Secure Enclave (kSecAttrTokenIDSecureEnclave) key custody designed

Android Keystore + StrongBox Keymaster (setIsStrongBoxBacked(true)) key custody designed

mobile JWT lifetime + refresh-token rotation defaults selected (access 15-60 min, refresh 30-90 days + rotation per 2025 standards)

first-party-only certificate pinning with backup public keys designed for high-risk mobile apps

Passkey / WebAuthn / FIDO2 server-side validation and signature-counter handling designed

Route elsewhere when the task is primarily:

static code security scanning: Sentinel

dynamic security testing: Probe

privacy engineering or PII handling:

Recipe	Subcommand	Default?	When to Use	Read First
Algorithm Selection	`algorithm`	✓	Crypto algorithm selection, parameter spec, anti-pattern detection	`reference/patterns.md`
Key Management	`key`		General key-management strategy (hierarchy, rotation policy, ceremony, derivation, revocation, destruction)	`reference/patterns.md`
E2EE Design	`e2ee`		End-to-end encryption architecture design	`reference/patterns.md`
TLS Configuration	`tls`		TLS/mTLS configuration, cipher suite selection, certificate management	`reference/patterns.md`
Signature Scheme	`signature`		Digital signature, JWT/JWE/JWS scheme design	`reference/patterns.md`
Password Hashing	`password`		Password-hashing scheme design (Argon2id / bcrypt / scrypt selection, OWASP 2024 parameters, pepper, bcrypt→Argon2id migration)	`reference/password-hashing.md`
KMS Integration	`kms`		KMS-service integration pattern (AWS KMS / GCP KMS / Azure Key Vault / Vault Transit), envelope encryption, data-key caching, HSM-backed CMK	`reference/kms-integration.md`
PQC Migration	`pqc`		Classical-to-post-quantum migration plan, hybrid schemes (X25519+ML-KEM), FIPS 203/204/205 target selection, harvest-now-decrypt-later response	`reference/post-quantum-migration.md`
Mobile Keys	`mobile`		iOS Keychain + Secure Enclave / Android Keystore + StrongBox design; Passkey / WebAuthn server-side validation; mobile JWT lifetime + refresh-token rotation defaults; first-party-only certificate-pinning design	`reference/patterns.md`

Signal	Approach	Primary output	Read next
`encrypt`, `encryption`, `AES`, `ChaCha`	Symmetric encryption design	Algorithm spec + key management	`reference/patterns.md`
`sign`, `signature`, `JWT`, `JWS`	Signature scheme design	Signing spec + verification flow	`reference/patterns.md`
`password`, `hash`, `bcrypt`, `Argon2`	Password storage design	Hashing spec + tuning parameters	`reference/patterns.md`
`key`, `KMS`, `rotation`, `HSM`	Key management design	Key lifecycle spec + KMS integration	`reference/patterns.md`
`E2EE`, `end-to-end`, `Signal`	E2EE architecture design	Protocol spec + key exchange design	`reference/patterns.md`
`TLS`, `mTLS`, `certificate`	TLS configuration design	Cipher suite spec + cert management	`reference/patterns.md`
`audit`, `review`, `anti-pattern`	Crypto anti-pattern detection	Audit report + fix recommendations	`reference/patterns.md`
`quantum`, `PQC`, `post-quantum`, `CNSA`	PQC migration plan	Migration roadmap + hybrid schemes + CNSA 2.0 compliance	`reference/patterns.md`
`Keychain`, `Secure Enclave`, `iOS key storage`	iOS Keychain + Secure Enclave design	`kSecAttrAccessControl` + biometry + Secure Enclave spec	`reference/patterns.md`
`Android Keystore`, `StrongBox`, `Keymaster`	Android Keystore + StrongBox design	StrongBox + biometric-gated key spec	`reference/patterns.md`
`Passkey server`, `WebAuthn validation`, `FIDO2 server`	Passkey server-side validation design	Attestation verify + signature counter + cloned-authenticator detection	`reference/patterns.md`
`mobile JWT`, `refresh token rotation`, `mobile auth lifetime`	Mobile JWT + refresh rotation design	Access 15-60min / refresh 30-90d rotation spec + algorithm pinning	`reference/patterns.md`
`certificate pinning`, `SSL pinning`, `public key pinning`	Certificate pinning design (first-party only)	Public-key pin + backup ≥ 2 + rotation plan	`reference/patterns.md`
unclear request	Algorithm selection (default)	Use-case-based recommendation	`reference/patterns.md`

Phase	Required action	Key rule	Read
`THREAT`	Identify threat model and compliance requirements	Know what you're defending against before choosing tools	—
`SELECT`	Choose algorithms based on use case and current standards	NIST/IETF current recommendations only; no deprecated defaults	`reference/patterns.md`
`DESIGN`	Design key lifecycle, protocol flow, and parameter specs	Key rotation built in; exact parameters specified	`reference/patterns.md`
`VERIFY`	Check for anti-patterns and quantum vulnerability	Every design gets anti-pattern checklist	`reference/patterns.md`
`DOCUMENT`	Produce specification with implementation guidance	Include library recommendations and code examples	—

Algorithm	Key size	Use case	Status
AES-256-GCM	256-bit	General purpose, authenticated	Recommended
ChaCha20-Poly1305	256-bit	Mobile/embedded, no AES-NI	Recommended
AES-256-CBC + HMAC	256-bit	Legacy compatibility	Acceptable
AES-128-GCM	128-bit	Performance-sensitive	Acceptable
3DES, RC4, Blowfish	—	—	Deprecated

Algorithm	Use case	Status
Argon2id	Password hashing (preferred)	Recommended — OWASP minimum: m=19MiB, t=2, p=1
bcrypt	Password hashing (established)	Acceptable — cost factor 10+
scrypt	Password hashing (memory-hard)	Acceptable
SHA-256/SHA-3	Data integrity, HMAC	Recommended
HKDF	Key derivation	Recommended
PBKDF2	Password hashing (legacy)	Acceptable (high iterations)
SHA-224, SHA-512/224, SHA3-224	Data integrity (short output)	Deprecated after 2030 (SP 800-131A Rev 3)
MD5, SHA-1	—	Deprecated for security

crypt

Options d'installation

Vérifiez les fichiers source

Crypt

Trigger Guidance

Crypt

Trigger Guidance

Core Contract

Boundaries

Always

Ask First

Never

Recipes

Subcommand Dispatch

Output Routing

Workflow

Algorithm Quick Reference

Symmetric Encryption

Hashing & KDF

Asymmetric / Signatures

Post-Quantum Cryptography (NIST PQC Standards)

Anti-Pattern Checklist

Output Requirements

Collaboration

Reference Map

Operational

AUTORUN Support

Nexus Hub Mode

name	crypt
description	Designing cryptographic architecture: algorithm selection, key management, E2EE, KMS integration, signature verification, and TLS configuration. Use when designing cryptographic protocols, key rotation flows, or end-to-end encryption architectures.

Algorithm	Key size	Use case	Status
Ed25519	256-bit	Digital signatures	Recommended
ECDSA (P-256)	256-bit	Digital signatures, TLS	Recommended
RSA-PSS	3072+ bit	Signatures (legacy compat)	Acceptable (RSA-2048 deprecated by 2030 per IR 8547)
X25519	256-bit	Key exchange	Recommended
ECDH (P-256)	256-bit	Key exchange	Recommended
RSA-OAEP	3072+ bit	Key wrapping	Acceptable

Standard	Algorithm	Use case	Status
FIPS 203 (ML-KEM)	CRYSTALS-Kyber	Key encapsulation	Recommended — finalized Aug 2024
FIPS 204 (ML-DSA)	CRYSTALS-Dilithium	Digital signatures (general)	Recommended — finalized Aug 2024
FIPS 205 (SLH-DSA)	SPHINCS+	Digital signatures (conservative, hash-based)	Recommended — finalized Aug 2024
FIPS 206 (FN-DSA)	FALCON	Digital signatures (compact)	In development — final standard expected 2026
HQC	HQC	Key encapsulation (code-based backup for ML-KEM, code-based math distinct from lattice)	Selected 2025-03-11 from NIST's fourth round; draft standard expected early 2026 with 90-day public comment, final standard targeted 2027 Source: NIST — Selects HQC as Fifth Algorithm for Post-Quantum Encryption

Anti-Pattern	Risk	Fix
ECB mode	Pattern leakage	Use GCM or CTR+HMAC
Fixed/reused IV/nonce	Plaintext recovery	Generate random IV per encryption
Weak RNG (`Math.random`)	Predictable keys	Use `crypto.getRandomValues` / `os.urandom`
Custom crypto primitives	Unknown vulnerabilities	Use libsodium, OpenSSL, or platform crypto
Key in source code	Key compromise (23.8M hardcoded credentials found on public GitHub in 2024)	Use KMS or env-injected secrets
No key rotation	Extended exposure window	Design rotation from day one
PKCS#1 v1.5 padding	Bleichenbacher attack	Use OAEP or PSS
JWT with `alg: none`	Authentication bypass	Validate algorithm server-side
Timing-vulnerable comparison	MAC/hash forgery via side channel	Use constant-time comparison (`crypto.timingSafeEqual`, `hmac.compare_digest`)
DSA for new signatures	Retired by SP 800-131A Rev 3	Use Ed25519, ECDSA, or ML-DSA
No crypto-agility	Locked to deprecated algorithms	Abstract algorithm behind config; support runtime substitution
Mobile `UserDefaults` / plain `SharedPreferences` for tokens	Root/jailbreak / backup extraction reveals secrets	iOS Keychain with `.biometryCurrentSet`; Android Tink-encrypted DataStore or `datastore-encrypted` 1.3.0-alpha07+
Android `EncryptedSharedPreferences` (`androidx.security:security-crypto:1.1.0-alpha07`)	Officially deprecated 2025-12	Migrate to Tink-encrypted DataStore or `androidx.datastore:datastore-encrypted`
Hardcoded API keys in mobile binary (MASWE-0005)	~50% of mobile apps fail this (Zimperium 2025); extractable by MobSF / APKLeaks in seconds	Proxy through BFF; use OAuth/PKCE with short-lived tokens
Mobile JWT without refresh-token rotation	Stolen refresh token replayable for full lifetime	Refresh on each use; revoke chain on replay of invalidated refresh
Mobile JWT `HS256` shared secret	Secret extractable from binary; allows token forgery	Use `ES256` (asymmetric, server-side private key) or `EdDSA`
Third-party-domain certificate pinning	Third party rotates → app dies without warning	Pin first-party endpoints only; ≥ 2 backup pins; reserve for high-risk apps

Direction	Handoff	Purpose
Sentinel → Crypt	`SENTINEL_TO_CRYPT_HANDOFF`	Crypto vulnerability for design fix
Oath → Crypt	`COMPLY_TO_CRYPT_HANDOFF`	Regulatory algorithm requirements
Crypt → Builder	`CRYPT_TO_BUILDER_HANDOFF`	Crypto implementation spec
Crypt → Sentinel	`CRYPT_TO_SENTINEL_HANDOFF`	Design for security verification

Reference	Read this when
`reference/patterns.md`	You need crypto design patterns, protocol templates, or anti-pattern details.
`reference/examples.md`	You need complete crypto architecture examples.
`reference/handoffs.md`	You need handoff templates for collaboration with other agents.
`reference/password-hashing.md`	You are designing the `password` recipe — Argon2id parameters, pepper strategy, bcrypt → Argon2id migration.
`reference/kms-integration.md`	You are designing the `kms` recipe — envelope encryption, data-key caching, HSM-backed CMK, provider selection.
`reference/post-quantum-migration.md`	You are planning the `pqc` recipe — HNDL threat model, NIST FIPS 203/204/205, hybrid schemes, timeline per regime.
`_common/OPUS_5_AUTHORING.md`	You are sizing the crypto spec, deciding adaptive thinking depth at DESIGN, or front-loading compliance scope/security-strength target at SCAN. Critical for Crypt: P3, P5.
`reference/autorun-schema.md`	You are emitting the AUTORUN `_STEP_COMPLETE` block — Crypt-specific Output/Next schema.

crypt

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Crypt

Trigger Guidance

Crypt

Trigger Guidance

Core Contract

Boundaries

Always

Ask First

Never

Recipes

Subcommand Dispatch

Output Routing

Workflow

Algorithm Quick Reference

Symmetric Encryption

Hashing & KDF

Asymmetric / Signatures

Post-Quantum Cryptography (NIST PQC Standards)

Anti-Pattern Checklist

Output Requirements

Collaboration

Reference Map

Operational

AUTORUN Support

Nexus Hub Mode

Plus depuis ce dépôt