detecting-weak-cryptography

name	detecting-weak-cryptography
description	Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token signing." Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: "scan weak crypto", "find MD5 usage", "check ECB mode", "audit ssl verify", "weak random".
allowed-tools	["Read","Bash(python3:*)","Glob","Grep"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","static-analysis","cryptography","pentest"]

Detecting Weak Cryptography

Overview

Weak cryptography (CWE-327 Use of a Broken or Risky Cryptographic Algorithm, CWE-330 Use of Insufficiently Random Values) shows up when engineers use the convenient API instead of the cryptographic one. hashlib.md5(password) is faster to type than the correct bcrypt/argon2 invocation; Math.random() returns a number quickly without needing to know about crypto.randomBytes().

The fix is universal: use the modern primitive. SHA-256 for general hashing, bcrypt/argon2/scrypt for passwords, AES-GCM for encryption, HMAC-SHA256 for signing, secrets / crypto.randomBytes / SecureRandom for randomness.

When the skill produces findings

Finding	Severity	Threshold	Affected control
MD5 used in security context	HIGH	hashlib.md5, MessageDigest.MD5, CryptoJS.MD5	CWE-327
SHA-1 used in security context	HIGH	hashlib.sha1, etc.	CWE-327
DES / 3DES cipher	CRITICAL	DESCrypto, "DES/CBC", "DESede"	CWE-327
RC4 cipher	CRITICAL	"ARC4", "RC4"	CWE-327
AES ECB mode	CRITICAL	"AES/ECB" or MODE_ECB	CWE-327
Hardcoded IV (initialization vector)	CRITICAL	IV literal in source	CWE-329
Custom XOR-based "encryption"	CRITICAL	XOR loop over bytes	CWE-327
Predictable random for crypto seed	CRITICAL	Math.random / java.util.Random / random.random for keys	CWE-330
TLS cert verification disabled	CRITICAL	verify=False, rejectUnauthorized:false, ServerCertificateValidationCallback returning true	CWE-295
Hardcoded HMAC secret	HIGH	Long literal in HMAC constructor	CWE-321