agentsclimarketplace
Sign in

Randomness auditor

Skill Yue-Zhou1/zkcrypto-audit/plugins/implementation-safety/skills/randomness-auditor

Audit randomness and nonce lifecycles: CSPRNG/DRBG initialization and reseeding, entropy availability, fork/clone/snapshot duplication, deterministic nonce derivation (RFC 6979, EdDSA), and reuse across retries, crashes, persistence, and concurrent state. Use when any secret-dependent random value's generation or lifetime is in question.From its SKILL.md

Install
npx -y skills add Yue-Zhou1/zkcrypto-audit --skill randomness-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.8 KB, 839 tokens by cl100k_base, as published. Nobody here has run it

randomness-auditor

Cross-cutting auditor for how random values are generated AND how they live: seeding, reseeding, duplication across process/VM boundaries, deterministic derivation, and reuse windows created by retries, crashes, logs, and concurrency.

When to Use

  • Auditing CSPRNG/DRBG construction, seeding, and reseed schedules
  • Reviewing entropy availability at boot, in containers, or on embedded targets
  • Checking fork/clone/VM-snapshot safety of RNG state
  • Reviewing deterministic nonce derivation (RFC 6979 ECDSA, RFC 8032 EdDSA) and any deviation from the scheme's RFC
  • Tracing nonce/salt/IV lifecycle across retry loops, crash recovery, persistence, logging, and concurrent use

When NOT to Use

  • AEAD mode/API misuse where generation is not in question (caller-supplied nonce binding, decrypt oracles) -> encryption-scheme-auditor
  • Pure timing/cache/power leakage with no randomness involvement -> side-channel-auditor
  • Signature verification-equation or encoding review -> the signature domain auditors
  • Threshold nonce-share binding (FROST/MuSig2) -> dkg-threshold-auditor; threshold-ECDSA presignatures -> threshold-ecdsa-auditor

Core Review Areas

  1. Generator construction: approved DRBG (SP 800-90A) or platform CSPRNG; no user-space PRNGs (Mersenne Twister, rand()) for secrets
  2. Seeding: entropy source, seed length, boot-time blocking behavior (getrandom vs /dev/urandom pre-init), embedded/first-boot entropy
  3. Reseeding and state compromise recovery: reseed intervals, prediction resistance claims, backtracking resistance
  4. Duplication: fork() and clone() detection, VM snapshot/resume, container image freezing, thread-local RNG cloning
  5. Deterministic nonces: exact RFC 6979 / RFC 8032 conformance — message binding, key binding, no truncation drift, no "deterministic + counter" improvisation
  6. Lifecycle: retries re-entering derivation with changed messages, crash recovery replaying persisted state, nonces in logs/telemetry, concurrent consumers sharing a generator without synchronization

Workflow

Phase 1: Random-value inventory

  • Read references/randomness-checklist.md
  • Enumerate every security-relevant random value (keys, nonces, salts, IVs, blinding factors, session IDs) and its generator

Phase 2: Lifecycle tracing

  • Execute workflows/nonce-lifecycle-review.md
  • For each value: generation -> use -> persistence -> destruction, across process lifecycle events (fork, snapshot, crash, retry)

Phase 3: Pattern hunt

  • Read references/finding-patterns.md
  • Prioritize forked-state duplication, snapshot resumption, RFC 6979 deviations, and persisted-counter replay

Phase 4: Handoff

  • Send surviving findings to crypto-fp-check
  • Cross-route consumer-scheme impact to the signature, encryption, DKG, threshold-ECDSA, or VRF auditors as applicable

Output Contract

Produce a randomness handoff that includes:

  • random_value_role
  • lifecycle_path
  • reuse_or_bias_condition
  • evidence
  • disposition (one of verified, false_positive, unverified, observation, residual_risk)
  • next_route

Reference Index

What ships with it: 5 files

10.8 KB alongside SKILL.md

agents/

references/

workflows/

Keep looking

Skills are one crate of 326,852. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.