crypto-compliance
The banned-primitive gate. Routed to when changed code hashes, signs, encrypts, derives keys, generates security-relevant randomness, configures TLS, or imports a crypto library. Rejects broken primitives, disabled TLS verification, and home-rolled crypto; the approved-primitive list lives in security-controls.md. The auth-crypto-reviewer agent is dispatched as the reviewer.
npx skills add arbiterForge/codeArbiter --skill crypto-compliance --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# crypto-compliance The banned-primitive gate. Routed to when changed code uses cryptography, hashing, signing, key derivation, security-relevant random generation, or TLS configuration. ## Pre-flight Read these, or STOP and surface the gap — never guess the policy: - `{{PROJECT_DIR}}/.codearbiter/security-controls.md` — the project's approved and forbidden primitives, key requirements, and TLS minimum. If this file is unreadable, BLOCK; do not infer the policy. ## Phase 1 — Banned-primitive scan · gate: BLOCK Scan every crypto operation in the changed code against `security-controls.md`. Apply the project's forbidden list; where it is silent, the following BLOCK unconditionally: - **Broken primitives** — `md5`, `sha1`/`sha-1` (including in HMAC or "just for IDs"), `des`, `3des`, `rc4`, and RSA keys below 2048 bits. - **Disabled TLS verification** — `rejectUnauthorized: false`, `verify: false`, or any disabling of certificate peer verification, on any connection. - **Home-rolled crypto** — a hand-built cipher, AEAD, KDF, signature scheme, or any reimplementation of a primitive in userland instead of a vetted, approved one. - **Unapproved primitive or library** — any algorithm, mode
- Pre-flight
- Phase 1 — Banned-primitive scan · gate: BLOCK
- Hard rules
What does the crypto-compliance skill do?
The banned-primitive gate. Routed to when changed code hashes, signs, encrypts, derives keys, generates security-relevant randomness, configures TLS, or imports a crypto library. Rejects broken primitives, disabled TLS verification, and home-rolled crypto; the approved-primitive list lives in security-controls.md. The auth-crypto-reviewer agent is dispatched as the reviewer.
How do I install it?
Run `npx skills add arbiterForge/codeArbiter --skill crypto-compliance --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From arbiterForge/codeArbiter, a repository with 138 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.