agentsclimarketplace
Sign in

Signature scheme auditor

Skill Yue-Zhou1/zkcrypto-audit/plugins/crypto-primitive-auditors/skills/signature-scheme-auditor

Audit classical signature schemes — generic ECDSA across curves, Schnorr/ BIP-340, EdDSA/Ed25519, RSA-PSS and PKCS#1 v1.5 — for verification-equation correctness, malleability, canonical encoding, public-key validation, and hash/prehash semantics. Use for standalone signature library review outside Ethereum application encoding, BLS, or threshold protocols.From its SKILL.md

Install
npx -y skills add Yue-Zhou1/zkcrypto-audit --skill signature-scheme-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.9 KB, 902 tokens by cl100k_base, as published. Nobody here has run it

signature-scheme-auditor

Domain auditor for classical single-party signature schemes: the verification equations, encodings, and key-validation rules of ECDSA, Schnorr/BIP-340, EdDSA, and RSA signatures.

When to Use

  • Auditing generic ECDSA signing/verification across ecosystems and curves (P-256, secp256k1, brainpool, etc.)
  • Reviewing Schnorr and BIP-340 x-only key handling, tagged hashes, and verification equations
  • Reviewing EdDSA/Ed25519 canonical encoding, cofactor semantics, and batch/single verification consistency
  • Reviewing RSA-PSS and PKCS#1 v1.5 verification and padding rules
  • Assessing malleability, public-key validation, and hash/prehash semantics

When NOT to Use

  • Ethereum-specific EIP-712, ecrecover, or application encoding -> ethereum-crypto-auditor
  • BLS signatures, pairings, aggregation -> ecc-pairing-auditor
  • Threshold schemes -> dkg-threshold-auditor (FROST/MuSig2) or threshold-ecdsa-auditor (GG/CGGMP)
  • Nonce generation/derivation mechanics -> randomness-auditor
  • Fault-attack resistance of signing hardware paths -> implementation-safety skills (verify-after-sign handoff)

Core Review Areas

  1. Verification equations: exact equation per scheme, all components checked (never trusting a library's partial verification)
  2. Range and canonicality: ECDSA r,s in [1, n-1]; Ed25519 s < L and canonical point encodings; BIP-340 x-only lift and even-y convention; PSS salt and v1.5 DigestInfo strictness
  3. Malleability: ECDSA (r, s)/(r, n-s); Ed25519 non-canonical s or A; scheme-level implications for consumers that key on signature bytes
  4. Public-key validation: on-curve, non-identity, correct subgroup (or cofactored equation), small-order rejection policy
  5. Hash and prehash semantics: which hash, truncation rules (FIPS 186-5 leftmost-bits), Ed25519ph/ctx variants, cross-protocol hash-domain reuse
  6. Batch vs single consistency: batch equations (cofactored) accepting what single (cofactorless) rejects, and consensus divergence risk
  7. Nonce integration: signing paths call correct derivation (RFC 6979 / RFC 8032) — deep RNG review hands off to randomness-auditor
  8. Verify-after-sign and fault-check posture at the API boundary

Workflow

Phase 1: Scheme inventory

  • Read references/signature-scheme-checklist.md
  • Identify every scheme/curve/hash triple in scope and the governing standard for each

Phase 2: Verification-path review

  • Execute workflows/signature-verification-review.md

Phase 3: Pattern hunt

  • Read references/finding-patterns.md
  • Prioritize missing range checks, permissive decoders, batch/single divergence, and v1.5 parsing tolerance

Phase 4: Handoff

  • Send surviving findings to crypto-fp-check
  • Cross-route nonce lifecycle to randomness-auditor, Ethereum encoding to ethereum-crypto-auditor, BLS/pairing math to ecc-pairing-auditor

Output Contract

Produce a signature-scheme handoff that includes:

  • signature_family
  • verification_or_signing_path
  • equation_or_encoding_invariant
  • evidence
  • disposition (one of verified, false_positive, unverified, observation, residual_risk)
  • next_route

Reference Index

What ships with it: 5 files

11.6 KB alongside SKILL.md

agents/

references/

workflows/

Gives 0 of the 12 instructions most quality gates skills give in 902 tokens

Counted across 1,195 of the 2,094 authors here whose files we hold, read 2026-08-07

  • Read the output and check the exit codein 54 of 1195, across 14 files
  • Verify requirements using a line-by-line checklistin 53 of 1195, across 12 files
  • Identify the verification command proving the claimin 51 of 1195, across 12 files
  • Run the full verification commandin 50 of 1195, across 11 files
  • Verify output confirms the claimin 49 of 1195, across 12 files
  • Check version control diff after agent delegationin 46 of 1195, across 6 files
  • State claim with evidencein 44 of 1195, across 4 files
  • Run the test suitein 33 of 1195, across 26 files
  • Keep state in memory by defaultin 27 of 1195, across 6 files
  • Make prototype runnable with one commandin 26 of 1195, across 5 files
  • Produce a verification reportin 25 of 1195, across 14 files
  • Detect the package manager from lockfilesin 24 of 1195, across 5 files

Said here and by no other author read

  • identify every scheme curve hash triple in scope
  • check exact verification equations per scheme
  • check range and canonicality of all components
  • test signature malleability
  • validate public keys for subgroup and order
  • verify hash and prehash semantics

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,871. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.