agentsclimarketplace

Encryption strategy

Skill bromso/metapowers/plugins/security/skills/encryption-strategy

A Claude Code plugin that adds an agentic skills framework, with MCP's and a meta prompting processes. Inspired by "Superpowers" & "Figma Console MCP", but not just for development or design; but for all aspect within the digital production cycle.

Install
npx -y skills add bromso/metapowers --skill encryption-strategy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Plan encryption at rest, in transit, and key management

SKILL.md

4.2 KB, 890 tokens by cl100k_base, as published. Nobody here has run it

Encryption Strategy

Plan encryption at rest, in transit, and key management for "$ARGUMENTS". Define encryption requirements based on data classification, select appropriate algorithms, and design the key management lifecycle.

Prerequisites

Read .metapowers/security/$ARGUMENTS/00-govern.md. If this file does not exist, tell the user:

Phase 0 (Govern) has not been completed for "$ARGUMENTS". Run a Govern skill first (e.g., /security:security-policy $ARGUMENTS), or use --skip-checks to bypass.

If --skip-checks is present in $ARGUMENTS, skip this check and log to .metapowers/security/$ARGUMENTS/skip-log.md.

Process

  1. Inventory data requiring encryption:

    • Map data types to classification levels (public, internal, confidential, restricted)
    • Identify regulatory encryption requirements (PCI DSS, HIPAA, GDPR, SOC 2)
    • Catalog data storage locations (databases, object storage, file systems, backups, caches)
    • Identify data flows between systems, services, and external parties

  2. Plan encryption at rest:

    • Select encryption algorithm (AES-256 recommended for symmetric encryption)
    • Evaluate database-level encryption (TDE) vs. application-level encryption
    • Database-level: simpler to implement, protects against physical media theft
    • Application-level: protects against database administrator access, enables field-level encryption
    • Plan encryption for file storage and object storage (S3 SSE, Azure Storage encryption)
    • Define encryption requirements for backup media and archives

  3. Plan encryption in transit:

    • Require TLS 1.3 minimum for all external communications (deprecate TLS 1.2 where possible)
    • Define certificate management strategy (public CA vs. internal CA, certificate lifecycle)
    • Plan mutual TLS (mTLS) for service-to-service communication where appropriate
    • Configure cipher suite preferences (forward secrecy required, disable weak ciphers)
    • Implement certificate pinning for critical mobile and API connections if applicable

  4. Design key management:

    • Select KMS solution (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault)
    • Define key hierarchy (master key, data encryption keys, key encryption keys)
    • Set key rotation schedule (master keys: annually, data encryption keys: quarterly or per-use)
    • Plan key backup and recovery procedures
    • Define key access controls (who can create, rotate, and revoke keys)
    • Document key compromise response procedure (re-encryption plan)

  5. Evaluate client-side vs. server-side encryption:

    • Client-side encryption for data the server should never see (zero-knowledge scenarios)
    • Server-side encryption for simpler key management and transparent encryption
    • End-to-end encryption for messaging and communication features
    • Document the decision rationale for each data type

  6. Plan encryption for backups:

    • Ensure all backups are encrypted with separate keys from production
    • Define backup key escrow and recovery procedures
    • Test backup decryption as part of disaster recovery exercises
    • Set retention-aligned key lifecycle (keys must outlive encrypted backup retention)

  7. Write the artifact to .metapowers/security/$ARGUMENTS/02-protect.md with heading:

    Encryption Strategy

    Include sections:

    • Data Encryption Requirements — data types, classification levels, and regulatory requirements
    • Encryption at Rest — algorithms, implementation approach per storage type
    • Encryption in Transit — TLS configuration, certificate management, mTLS plan
    • Key Management — KMS selection, key hierarchy, rotation schedule, and access controls
    • Client-Side vs. Server-Side — decisions per data type with rationale
    • Backup Encryption — backup-specific encryption and key escrow plan

Output

The encryption strategy written to .metapowers/security/$ARGUMENTS/02-protect.md. Present a summary to the user highlighting:

  • Data types requiring encryption and their classification levels
  • Encryption approach per storage and transit scenario
  • Key management solution and rotation schedule
  • Critical decisions on client-side vs. server-side encryption

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.