Br crypto

Skill Lonsdale201/wp-agent-skills/better-route/br-crypto

A community-maintained collection of agent skills for WordPress plugin and theme development.

Install

npx -y skills add Lonsdale201/wp-agent-skills --skill br-crypto

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use Better Route 1.1 cryptographic helpers for secure random tokens, Hex/Base64/Base64URL encoding, strict Base64URL decoding, and constant-time secret comparison. Use when implementing nonces, state, PKCE, opaque tokens, or signature comparisons.

SKILL.md

2.1 KB, as published. Nobody here has run it

Better Route crypto helpers

Use the library helpers instead of reimplementing small security primitives.

use BetterRoute\Support\Crypto;
use BetterRoute\Support\CryptoEncoding;

$state = Crypto::token(32); // Base64URL by default.
$nonce = Crypto::token(32, CryptoEncoding::Base64Url);
$hex = Crypto::tokenHex(32);

$encoded = Crypto::base64UrlEncode($raw);
$decoded = Crypto::base64UrlDecode($encoded);

if (!Crypto::equals($expected, $provided)) {
    throw new \BetterRoute\Http\ApiException('Invalid token.', 401, 'invalid_token');
}

Rules

Pass entropy in bytes, not output-character count. The default 32 bytes provides 256 bits before encoding.
Crypto::token() uses random_bytes() and accepts CryptoEncoding::Hex, Base64, or Base64Url, including their lowercase string values.
Crypto::base64UrlDecode() validates alphabet, padding placement, length, and decoder success; catch RuntimeException at an input boundary if malformed input should become a client error.
Use Crypto::equals() only with strings of the expected representation. Decode/normalize representations before comparing, but never perform lossy case normalization on secret material.
Use br-single-use-token when a token must also be consumed atomically, br-hmac-signature for request signing, and br-jwks-jwt-auth for JWTs.

Do not use these helpers as password hashing, encryption, key derivation, or a substitute for a protocol-specific verifier.

Source references: src/Support/Crypto.php, src/Support/CryptoEncoding.php.

References