Guide · Agent skill
How to use the Applied Cryptography Expert agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The crypto-expert skill is a set of written instructions that makes your AI agent answer encryption questions the way a senior security engineer would. It covers TLS, symmetric and asymmetric encryption, hashing, digital signatures and key management. After reading this guide you will know what the skill changes, how to install it, how to ask for it in plain language, and where its limits are.
Applied Cryptography ExpertRightNow-AI/openfang · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the crypto-expert ZIP from the directory page where you found this guide.
- 2Unzip the skill. Extract the archive so that SKILL.md sits inside a crypto-expert folder.
- 3Place it in the skills folder. Move the folder to ~/.claude/skills/ for personal use, or to .claude/skills/ in your project.
- 4Or upload it in the Claude apps. In the Claude apps, open Settings → Capabilities → Skills and upload the skill there instead.
- 5Ask a crypto question. Make a normal request about TLS, encryption, hashing or key management, and include your code or config.
- 6Verify the answer. Check the advice against trusted references and have a qualified professional review anything for production.
What the crypto-expert skill makes the agent do
An agent skill is a folder containing a SKILL.md file of instructions that the AI agent reads when a task matches the skill. This one is a cryptography expert. When you ask about encryption, TLS certificates, password hashing, digital signatures or key storage, the agent reasons and writes in that expert role.
The skill pushes the agent toward well-audited libraries such as OpenSSL, libsodium, ring and RustCrypto, and toward modern choices such as AES-256-GCM, ChaCha20-Poly1305 and Ed25519. It also warns about common mistakes. The source names reusing nonces, using ECB mode and comparing secrets with ordinary string equality.
- Recommends high-level, reviewed libraries instead of custom code
- Suggests Argon2id, bcrypt or scrypt for password storage
- Flags nonce reuse, ECB mode, missing authentication and non-constant-time comparison
- Explains envelope encryption, HKDF key derivation and short-lived JWT design
Install the crypto-expert skill from the ZIP
Download the crypto-expert ZIP from the directory page, then unzip it. You can put the skill in one of two places. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills. The skill's only file is SKILL.md, so the folder you unpack should contain that file.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
~/.claude/skills/How to trigger the skill with natural requests
You do not need a special command. Ask a normal question about one of the skill's topics: TLS, symmetric or asymmetric encryption, hashing, or key management. The skill's description is 'Cryptography expert for TLS, symmetric/asymmetric encryption, hashing, and key management', so requests that match those topics are the ones it is written for.
Say what you are building and what you are unsure about. The skill's advice is more useful when it knows the context, such as whether you are storing passwords, signing tokens or designing a key store.
- 'Review how I encrypt user files with AES-GCM in this code.'
- 'Which algorithm should I use to sign JWTs in a mobile app?'
- 'Is this password hashing function good enough for storing logins?'
- 'Check my TLS setup for nginx and suggest a safer cipher configuration.'
Examples of what good answers look like
Suppose you ask how to store passwords. Under this skill, the agent should recommend Argon2id, bcrypt or scrypt with suitable cost parameters, and explain why SHA-256 and MD5 are not suitable for password storage.
For TLS, the skill points toward TLS 1.3 with a limited set of cipher suites. Its example directive is shown below. For signatures, it prefers Ed25519 over RSA and explains the trade-off in key size and security level.
- Passwords: Argon2id first, then bcrypt or scrypt; avoid SHA-256 and MD5 for this purpose
- Signatures: Ed25519 preferred; ES256 is also mentioned for JWTs
- Encryption: AES-256-GCM with AES-NI hardware, ChaCha20-Poly1305 without it
- Key storage: envelope encryption with a KMS or HSM where possible
ssl_protocols TLSv1.3What the skill needs and how it stays safe
The skill lists no requirements. It does not run scripts and does not use the network, according to its listing. It has no tools of its own. It only changes how the agent reasons and writes, and it does not give the agent access to your systems.
Because the skill is only a text prompt, it has not been tested or audited. Its advice can be wrong or out of date. Treat its output as a starting point for review, and have a qualified professional verify anything that goes to production.
- Requirements: none listed
- Runs scripts: no
- Uses network: no
- Licence: Apache-2.0
- Not a substitute for a security audit or sign-off
Tips for getting the most from the skill
Paste the relevant code or configuration into the conversation, not just a description. The skill can then point to specific lines, such as a nonce that is reused or a comparison using ==.
The skill advises against writing new cryptographic primitives, so do not expect it to help build a custom cipher. Ask it instead which existing library and mode fit your use case.
- Include the algorithm, library and mode you are currently using
- State your threat model, such as who you are protecting data from
- Ask for a list of pitfalls to check in your existing design
- Ask it to explain its reasoning so you can verify it
What people use it for
- Reviewing whether a web app's password hashing uses an appropriate algorithm and cost settings
- Checking a TLS configuration and suggesting TLS 1.3 with a limited set of cipher suites
- Choosing between Ed25519, ES256 and RSA for signing JWTs or other data
- Reviewing a design for envelope encryption and key rotation before implementation
- Learning applied cryptography through principled guidance instead of hand-rolled examples
Frequently asked questions
How do I install the crypto-expert agent skill?
Download the ZIP from the directory page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What does the crypto-expert skill require?
The listing shows no requirements. It does not run scripts and does not use the network. It only changes how the agent reasons and writes, and it adds no new tools.
Is the crypto-expert skill free to use?
The skill is published under the Apache-2.0 licence, as listed on the directory page. Check the licence file in the source repository for the full terms.
Can I rely on the crypto-expert skill for production security sign-off?
No. The skill is a text prompt with no testing or audit, and its advice can be wrong or out of date. Have a qualified professional verify any design or code before it goes to production.
Why doesn't the skill trigger when I ask about encryption?
The skill is selected by matching your request to its description, which covers TLS, symmetric and asymmetric encryption, hashing and key management. Mention one of those topics explicitly and include the relevant code or config so the request clearly fits.
How does this skill compare with asking the agent without it?
With the skill installed, the agent follows the expert guidance in SKILL.md, such as preferring audited libraries and warning about nonce reuse and ECB mode. This guide does not compare it with other skills, so test both on your own question to judge the difference.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a developer wanting a sanity check on encryption, hashing or JWT signing, a student learning applied cryptography, or a team reviewing a TLS or key management design. Pick something else, or a qualified security professional, if you need production sign-off or help building new cryptographic code, since the skill itself advises against writing custom primitives.
Download the skill