Crypto Compliance Agent Skill

The banned-primitive gate. Routed to when changed code hashes, signs, encrypts, derives keys, generates security-relevant randomness, configures TLS, or imports a crypto library. Rejects broken primitives, disabled TLS verification, and home-rolled crypto; the approved-primitive list lives in security-controls.md. The auth-crypto-reviewer agent is dispatched as the reviewer.

795 tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

138

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/arbiterForge/codeArbiter --skill crypto-compliance

The instruction itself

4 sections, as written by the author

crypto-compliance

The banned-primitive gate. Routed to when changed code uses cryptography, hashing, signing, key derivation, security-relevant random generation, or TLS configuration.

Pre-flight

Read these, or STOP and surface the gap — never guess the policy:

${CLAUDE_PROJECT_DIR}/.codearbiter/security-controls.md — the project's approved and forbidden primitives, key requirements, and TLS minimum. If this file is unreadable, BLOCK; do not infer the policy.

Phase 1 — Banned-primitive scan · gate: BLOCK

Scan every crypto operation in the changed code against security-controls.md. Apply the project's forbidden list; where it is silent, the following BLOCK unconditionally:

Broken primitives — md5, sha1/sha-1 (including in HMAC or "just for IDs"), des, 3des, rc4, and RSA keys below 2048 bits.
Disabled TLS verification — rejectUnauthorized: false, verify: false, or any disabling of certificate peer verification, on any connection.
Home-rolled crypto — a hand-built cipher, AEAD, KDF, signature scheme, or any reimplementation of a primitive in userland instead of a vetted, approved one.
Unapproved primitive or library — any algorithm, mode, key size, or crypto library not on the approved list in security-controls.md.

Dispatch the auth-crypto-reviewer agent (${CLAUDE_PLUGIN_ROOT}/agents/auth-crypto-reviewer.md) to confirm these findings against security-controls.md.

Gate: no banned or unapproved primitive, no disabled TLS verification, and no home-rolled crypto in the changed code.

On pass — record the gate: follow ${CLAUDE_PLUGIN_ROOT}/includes/security-gate-record.md (the shared record mechanism). For this gate the relevant commit hook is H-09b (crypto/TLS). On any BLOCK, do NOT record the pass.

Out-of-scope finding: do not act on it and do not author an ADR (ADRs are user-attributed, via /adr only). Mark it inline with [NEEDS-TRIAGE]; never silently drop it.

Hard rules

MUST read security-controls.md before scanning — BLOCK if it cannot be read.
MUST NOT use MD5, SHA1, DES, 3DES, RC4, or RSA below 2048 bits — even for non-security checksums or IDs.
MUST NOT set verify: false or rejectUnauthorized: false, or otherwise disable certificate verification, on any TLS connection.
MUST NOT use a home-rolled or userland-reimplemented cryptographic primitive.
MUST NOT use any primitive, key size, or crypto library not on the approved list in security-controls.md.
MUST record the security-gate-passed marker (via hooks/security-pass.py) ONLY when the gate genuinely passes — the marker is what unblocks the commit (hook H-09b), so a premature or unconditional recording defeats the gate.

Other skills for the same job

different authors, same section of the catalogue

Invoice Organizer

by frostant

×5

Automatically organizes invoices and receipts for tax preparation by reading messy files, extracting key information, renaming them consistently, and sorting them into logical folders. Turns hours of manual bookkeeping into minutes of automated organization.

Expert guidance for systematic backtesting of trading strategies. Use when developing, testing, stress-testing, or validating quantitative trading strategies. Covers "beating ideas to death" methodology, parameter robustness testing, slippage modeling, bias prevention, and interpreting backtest results. Applicable when user asks about backtesting, strategy validation, robustness testing, avoiding overfitting, or systematic trading development.

15k tokens scripts

Analyzing Financial Statements

by anthropics

vendor ×2

This skill calculates key financial ratios and metrics from financial statement data for investment analysis

8k tokens scripts

Creating Financial Models

by anthropics

vendor ×2

This skill provides an advanced financial modeling suite with DCF analysis, sensitivity testing, Monte Carlo simulations, and scenario planning for investment decisions

This skill retrieves upcoming earnings announcements for US stocks using the Financial Modeling Prep (FMP) API. Use this when the user requests earnings calendar data, wants to know which companies are reporting earnings in the upcoming week, or needs a weekly earnings review. The skill focuses on mid-cap and above companies (over $2B market cap) that have significant market impact, organizing the data by date and timing in a clean markdown table format. Supports multiple environments (CLI, Desktop, Web) with flexible API key management.

Crypto wallet operations via the awal CLI — sign in, check balances, send USDC/ETH/POL/SOL, trade tokens, fund the wallet, and use the x402 payment protocol to discover paid services, pay for API calls, monetize an API, or query onchain data. Use whenever the user mentions signing in, login, authentication, wallet status, balance, address, sending money, paying someone, transferring tokens, ENS names, swapping/trading/converting tokens, funding/topping up/onramp, USDC, ETH, POL, SOL, the x402 bazaar, paid APIs, monetizing an endpoint, or querying onchain data on Base.

Access real-time and historical stock market data, forex rates, cryptocurrency prices, commodities, economic indicators, and 50+ technical indicators via the Alpha Vantage API. Use when fetching stock prices (OHLCV), company fundamentals (income statement, balance sheet, cash flow), earnings, options data, market news/sentiment, insider transactions, GDP, CPI, treasury yields, gold/silver/oil prices, Bitcoin/crypto prices, forex exchange rates, or calculating technical indicators (SMA, EMA, MACD, RSI, Bollinger Bands). Requires a free API key from alphavantage.co.

Braintree Automation: manage payment processing via Stripe-compatible tools for customers, subscriptions, payment methods, and transactions

2k tokens needs MCP

How to use it

Copy the folder

Take arbiterforge/codearbiter-ca-crypto-compliance from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.