Openssl

Generate secure random strings, passwords, and cryptographic tokens using OpenSSL. Use when creating passwords, API keys, secrets, or any secure random data.

Security Scan

The skill's instructions match its stated purpose (generating random secrets with OpenSSL) and it is instruction-only, but the metadata omits required binaries and there are a few practical/security caveats in the commands.

Purpose & Capability

The name, description, and SKILL.md all describe generating secure random strings with OpenSSL — that is coherent. However, the skill metadata declares no required binaries even though the instructions explicitly call external utilities (openssl, tr, head, xxd, od). The metadata should list these as required binaries so callers know runtime dependencies.

Instruction Scope

The SKILL.md is narrowly scoped to running openssl rand and small text transformations; it does not request files, environment secrets, or external network calls. Caveats: piping through 'tr -dc' to restrict character sets can reduce or bias entropy and may produce shorter outputs (requiring loops to reach intended length). The PIN-generation pipeline is complex and depends on several utilities; it may behave unpredictably across platforms.

Install Mechanism

There is no install spec and no code files (instruction-only), so nothing is written to disk by the skill itself. This is the lowest-risk install posture.

Credentials

The skill requests no environment variables or credentials, which is appropriate for its purpose (local random generation).

Persistence & Privilege

The skill is not always-enabled and does not request persistent privileges or modify other skills/configuration. Agent autonomous invocation is allowed (platform default) but not combined with other risky requests.

Assessment

This skill is coherent for generating random data, but review these points before installing: 1) Metadata omission: the SKILL.md runs external programs (openssl, tr, head, xxd, od); the skill should declare required binaries so you know the agent must have them on PATH. 2) Entropy caution: filtering base64 with 'tr -dc' or truncating output can reduce or bias entropy and may yield shorter strings than expected — prefer deterministic methods (e.g., openssl rand -hex for raw key material) and verify lengths. 3) Portability: some pipelines (xxd, od) may behave differently on non-Linux platforms. 4) Safety: the skill runs local commands but does not exfiltrate data; nevertheless ensure your agent runs in a secure environment and that any generated secrets are handled/stored securely. If you plan to use these commands programmatically (in services or client code), consider using a vetted cryptography library in your runtime language rather than shelling out to openssl plus filters.

OpenSSL Secure Generation

Generate cryptographically secure random data using openssl rand.

Password/Secret Generation

# 32 random bytes as base64 (43 chars, URL-safe with tr)
openssl rand -base64 32 | tr '+/' '-_' | tr -d '='

# 24 random bytes as hex (48 chars)
openssl rand -hex 24

# alphanumeric password (32 chars)
openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c 32

Common Lengths

Use Case	Command
Password (strong)	openssl rand -base64 24
API key	openssl rand -hex 32
Session token	openssl rand -base64 48
Short PIN (8 digits)	`openssl rand -hex 4

Notes

• -base64 outputs ~1.33x the byte count in characters
• -hex outputs 2x the byte count in characters
• Pipe through tr -dc to filter character sets
• Always use at least 16 bytes (128 bits) for secrets