From soundcheck
Catches cryptographic primitive misuse that pattern matchers miss — nonce reuse, k-value reuse, length-extension, padding oracle leaks, and secret-dependent branches. Use when calling AEAD, ECDSA, raw hash, or RSA decrypt directly.
How this skill is triggered — by the user, by Claude, or both
Slash command
/soundcheck:crypto-library-misuseThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Cryptographic primitives are correct only when their preconditions are met. Not
Cryptographic primitives are correct only when their preconditions are met. Not
"weak algorithm picked" — that's cryptographic-failures. These are "right
primitive, wrong wiring": nonce reused, per-signature random reused, comparison
branches on secret bits, exception type leaks which decryption failure happened.
Each pattern below has produced a real CVE (Sony PS3 ECDSA k-reuse, Marvin RSA timing).
hash(secret || msg) as a MAC. SHA-2
length-extension lets an attacker forge a valid tag over an extended message.Flag the vulnerable call site and explain the risk. Then suggest a fix that establishes these properties:
secret || msg. HMAC's two-pass construction defeats length-extension.Translate these principles to the audited file's language and crypto library. Use the documented high-level API (AEAD wrapper, signing context, HMAC primitive, constant-time-compare helper) — do not assemble these guarantees by hand.
After rewriting, confirm:
hash(secret || msg); HMAC or a MAC primitive is usednpx claudepluginhub thejefflarson/soundcheck --plugin soundcheckDetects weak or broken cryptography: weak password hashing, non-cryptographic PRNG for tokens, hardcoded keys, and insecure encryption modes.
Detects cryptographic failures like weak hashing (MD5/SHA1), hardcoded secrets, insecure randomness in Python, Java, Go, PHP, TypeScript code using grep patterns for whitebox pentesting.
Audits cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation. Deeper than OWASP A02.