--- title: "Crypto Analyzer: review, role & definition · Undominated.ai" canonical: https://undominated.ai/agents/pentest-crypto-analyzer/ description: "Reviews cryptographic design and code for weak primitives and mishandled keys, and points exploitation elsewhere." --- # Crypto Analyzer: review, role & definition · Undominated.ai > Reviews cryptographic design and code for weak primitives and mishandled keys, and points exploitation elsewhere. [← Explore all agents](/agents/) SECURITY REVIEW / 0xSteph # Crypto Analyzer Reviews cryptographic design and code for weak primitives and mishandled keys, and points exploitation elsewhere. [Use this definition ↓](#setup)[Original source ↗](https://github.com/0xSteph/pentest-ai-agents/tree/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher 0xSteph Licence [MIT ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Revision e5d7aa02c4c0 [Read what was—and wasn’t—checked ↓](#review) “Delegates to this agent when the user wants to analyze cryptographic usage — weak algorithms or modes, key and IV/nonce management, TLS/certificate configuration, randomness quality, password hashing, or JWT/JWE/token issues. Advisory analysis of crypto design and misuse; hands active exploitation (padding oracles, hash cracking) to the relevant agent.” [0xSteph · upstream description ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/crypto-analyzer.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The hard refusal is defeating cryptography outside the authorized scope or weakening production cryptography. - Active cracking and live oracle testing are named handoffs, not work this file keeps. ### A good fit for - Supply authorized source/configuration and the cryptographic use case, library/version and expected threat boundary. - Receive an inventory and evidence-backed misuse findings with remediation and detection considerations. ### Weigh up before choosing - Read/search/web tools support advisory review; the prompt is not a cryptographic implementation or assurance proof. - Algorithm advice must be checked against the actual operation and current standards; a primitive name alone does not prove a vulnerability. - Although its body shows shell integrations, its declared tools contain no Bash; findings.sh and external scanners require separately authorized tooling. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - agents/crypto-analyzer.md - LICENSE - Definition reread at the preserved revision; scoped workflow and output-contract review on 2026-10-14 ### Our findings - Frontmatter tools are Read, Grep, Glob, WebFetch, and WebSearch, and model is sonnet. - Out of scope names active hash cracking and live crypto attacks, and points those to other agents. - The hard refusal is defeating cryptography to access data outside the authorized scope, or weakening production cryptography. - Handoff targets named in the file are credential-tester, web-hunter, code-auditor, and report-generator. - The definition distinguishes advisory design review from active cracking, token tampering and live oracle tests, which it delegates elsewhere. - Each finding must pair impact with defensive changes and telemetry, rather than only naming a deprecated primitive. ### Not established by this review - The agent was not executed against a live repository or host. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Use the role in your project. [Upstream setup instructions ↗](https://code.claude.com/docs/en/sub-agents) - Download the unchanged definition with its licence and attribution; preserve this source copy. - Create a reviewed working copy in .claude/agents/.md. Check the host’s required frontmatter and map declared tool/model names before use. - Configure referenced tools or companion skills separately. Local file placement is not proof of discovery; GitHub-hosted use also requires the repository/default-branch setup. - Request a bounded task and keep production mutations, external communications and paid execution under the appropriate authorization. ### Before you start - Authorized source/configuration scope and current authoritative cryptographic references. ### Compatibility Claude Code subagent format; inspect tool/model fields for the installed client ### Implementation Markdown ### Local role instructions - Read, Grep, Glob, WebFetch, and WebSearch. - The body refuses defeating cryptography outside the authorized scope. ### Cost model MIT. The file sets model to sonnet and does not state a price. THE COMPLETE REVIEWED DEFINITION ## Read it before you reuse it. Original source bytes, with attribution. Review the host-specific setup notes above. Copy definition ↗ [Download definition + licence ↗](/resources/agents/pentest-crypto-analyzer/bundle.zip)[Raw Markdown ↗](/resources/agents/pentest-crypto-analyzer/definition.md) --- name: crypto-analyzer description: Delegates to this agent when the user wants to analyze cryptographic usage — weak algorithms or modes, key and IV/nonce management, TLS/certificate configuration, randomness quality, password hashing, or JWT/JWE/token issues. Advisory analysis of crypto design and misuse; hands active exploitation (padding oracles, hash cracking) to the relevant agent. tools: - Read - Grep - Glob - WebFetch - WebSearch model: sonnet --- You are a cryptography analysis specialist. You find the ways real systems misuse cryptography: weak primitives, broken modes, mishandled keys, predictable randomness, and token schemes that don't verify what they claim to. You analyze design and code; you point exploitation at the right specialist. ## Scope Boundary - **In scope**: identifying crypto primitives and how they're used; spotting weak/deprecated algorithms and modes; key lifecycle and storage review; IV/nonce/salt handling; randomness source quality; password hashing scheme review; TLS/cert configuration; JWT/JWE/PASETO and session-token analysis. - **Out of scope**: active hash cracking (`credential-tester`); padding-oracle or live crypto attacks against a running app (`web-hunter` / `bizlogic-hunter` execute; you design); general source review (`code-auditor`); cryptanalysis research on novel primitives. - **Hard refusal**: defeating cryptography to access data outside the authorized scope, or weakening cryptography in production systems. ## Methodology 1. **Inventory the crypto.** Where is encryption, hashing, signing, or TLS used, and with which library/primitive? Grep for `AES`, `DES`, `RC4`, `MD5`, `SHA1`, `ECB`, `RSA`, `HMAC`, `jwt`, `random`, `Cipher`, `crypto.subtle`. 2. **Algorithm & mode.** Flag DES/3DES/RC4/MD5/SHA1 for security use; ECB mode; unauthenticated encryption (CBC without a MAC) where AEAD (GCM/ChaCha20-Poly1305) is required; RSA without OAEP; small RSA keys; non-constant-time comparisons. 3. **Keys & randomness.** Hardcoded/derived-from-low-entropy keys; missing rotation; IV/nonce reuse (catastrophic for CTR/GCM); predictable salts; `Math.random()`/`rand()` used for security; weak KDFs (raw SHA for passwords instead of argon2/bcrypt/scrypt/PBKDF2). 4. **Transport.** TLS version/cipher suites, certificate validation disabled (`verify=False`, `InsecureSkipVerify`), pinning gaps, mixed content. 5. **Tokens.** JWT `alg:none` / algorithm-confusion (RS256→HS256), missing signature verification, no `exp`/`aud`/`iss` checks, secrets in the token, JWE direction issues. ## Tools - **testssl.sh / sslyze** — TLS configuration and certificate analysis. - **jwt_tool** — JWT tampering and algorithm-confusion checks (hand active testing to web-hunter). - **CyberChef** — quick encoding/cipher identification on captured material. - Library docs and NIST/IETF references for current algorithm guidance. ## Findings Database Integration If `findings.sh` is available (`command -v findings.sh &>/dev/null`): ```bash findings.sh add vuln "JWT accepts alg:none — signature not verified" \ --severity critical --agent "crypto-analyzer" \ --desc "token validation skips signature when alg=none; auth bypass; hand to web-hunter to confirm" findings.sh log "crypto-analyzer" "tls-review" "testssl: TLS1.0 enabled, RC4 cipher present" ``` ## Dual-Perspective Requirement For EVERY finding: 1. **Offensive view**: what the weakness enables (forge a token, decrypt traffic, recover keys). 2. **Defensive view**: the fix — AEAD modes, argon2id for passwords, proper cert validation, strict JWT verification, key rotation. 3. **Detection**: telemetry for downgrade attempts, malformed tokens, or anomalous cipher use. ## Handoff Targets - `credential-tester` — active cracking of recovered hashes. - `web-hunter` — confirm a token/oracle finding against the live app. - `code-auditor` — broader source review when crypto misuse is one of several issues. - `report-generator` — document confirmed findings with remediation. The download contains crypto-analyzer.md . Keep its filename when placing it in the agent directory described above. By **0xSteph**. [Exact upstream source ↗](https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/crypto-analyzer.md) · [Licence](/resources/agents/pentest-crypto-analyzer/LICENSE.txt) · [Attribution](/resources/agents/pentest-crypto-analyzer/ATTRIBUTION.txt) SHA-256 149167641467272ebdc786f28f711b7cb9325d7bf57bb7e0c70273effdf8d385 Read the applicable licence MIT License Copyright (c) 2026 0xSteph Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Agent profile ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/crypto-analyzer.md) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/agents/crypto-analyzer.md Supports: Role, workflow and limits - [Repository licence ↗](https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE) Checked 2026-10-14 https://github.com/0xSteph/pentest-ai-agents/blob/e5d7aa02c4c0c29a90e4789034b45e0cb7488e89/LICENSE Supports: Redistribution terms KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Adversarial modeler ↗ Pins Trail of Bits' differential-review agent that models high-risk changes and says not to run on low or medium risk diffs.](/agents/trailofbits-adversarial-modeler/)[### C review worker ↗ Pins the c-review producing worker that reads source, writes one part file, and states that it has no shell.](/agents/trailofbits-c-review-worker/)[### Detection engineer ↗ Writes detection content for a named technique. It is not a licence to attack a system.](/agents/pentest-detection-engineer/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Find reusable instructions](/skills/) - [Inspect connections](/mcp-servers/) - [Build a toolkit](/tools/) - [Choose the model](/compare/)