Security audit
Security checks for vulnerabilities and agentic risk
This is a local weak-cryptography scanner with some accuracy/documentation caveats but no evidence of hidden, persistent, or malicious behavior.
Install only if you are comfortable with a local scanner reading the source paths you provide and printing matching lines that may contain secrets. Treat results as heuristic and review the documented coverage and severity mismatches before relying on it as a CI gate.
The documentation states SHA256 password hashing is flagged at MEDIUM, while the implementation assigns HIGH severity for SHA256 in CR001. In a CI fail-gate security tool, severity mismatches can change merge-blocking behavior and lead teams to mis-triage real cryptographic weaknesses based on inaccurate documentation.
The description says the skill scans Python, JavaScript/TypeScript, Go, Java, and PHP source code for 10 classes of insecure cryptography. In code, support is uneven and partly inconsistent with that claim: for example CR007 only looks for bcrypt/argon2 APIs in Python/JS-style forms and misses the Java/Go/PHP forms implied by the manifest, while SUPPORTED_EXTENSIONS also includes Ruby and Kotlin despite those languages not being declared. This makes the stated coverage broader and cleaner than the actual implementation.
The documentation claims CR008 detects cases where applications use only HS256 without RS256/ES256 options, but the implementation only detects hardcoded JWT secrets and alg=none. This creates a false sense of coverage in a security scanning skill, causing users to rely on a control that does not actually detect the advertised weakness.
Detected: suspicious.exposed_secret_literal
