Is constant-time-analysis safe to install?

SaferSkills independently audited constant-time-analysis (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/constant-time-analysis/SKILL.md · 1 file

skills/constant-time-analysis/SKILL.md5.3 KB · Markdown

name: constant-time-analysis

description: Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

category: Security & Systems

source: antigravity

tags: [python, javascript, typescript, node, api, ai, document, vulnerability, cro]

url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/constant-time-analysis

Constant-Time Analysis

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

When to Use

User writing crypto code? ──yes──> Use this skill
         │
         no
         │
         v
User asking about timing attacks? ──yes──> Use this skill
         │
         no
         │
         v
Code handles secret keys/tokens? ──yes──> Use this skill
         │
         no
         │
         v
Skip this skill

Concrete triggers:

User implements signature, encryption, or key derivation
Code contains / or % operators on secret-derived values
User mentions "constant-time", "timing attack", "side-channel", "KyberSlash"
Reviewing functions named sign, verify, encrypt, decrypt, derive_key

When NOT to Use

Non-cryptographic code (business logic, UI, etc.)
Public data processing where timing leaks don't matter
Code that doesn't handle secrets, keys, or authentication tokens
High-level API usage where timing is handled by the library

Language Selection

Based on the file extension or language context, refer to the appropriate guide:

Language	File Extensions	Guide
C, C++	`.c`, `.h`, `.cpp`, `.cc`, `.hpp`	references/compiled.md
Go	`.go`	references/compiled.md
Rust	`.rs`	references/compiled.md
Swift	`.swift`	references/swift.md
Java	`.java`	references/vm-compiled.md
Kotlin	`.kt`, `.kts`	references/kotlin.md
C#	`.cs`	references/vm-compiled.md
PHP	`.php`	references/php.md
JavaScript	`.js`, `.mjs`, `.cjs`	references/javascript.md
TypeScript	`.ts`, `.tsx`	references/javascript.md
Python	`.py`	references/python.md
Ruby	`.rb`	references/ruby.md

Quick Start

# Analyze any supported file type
uv run {baseDir}/ct_analyzer/analyzer.py <source_file>

# Include conditional branch warnings
uv run {baseDir}/ct_analyzer/analyzer.py --warnings <source_file>

# Filter to specific functions
uv run {baseDir}/ct_analyzer/analyzer.py --func 'sign|verify' <source_file>

# JSON output for CI
uv run {baseDir}/ct_analyzer/analyzer.py --json <source_file>

Native Compiled Languages Only (C, C++, Go, Rust)

# Cross-architecture testing (RECOMMENDED)
uv run {baseDir}/ct_analyzer/analyzer.py --arch x86_64 crypto.c
uv run {baseDir}/ct_analyzer/analyzer.py --arch arm64 crypto.c

# Multiple optimization levels
uv run {baseDir}/ct_analyzer/analyzer.py --opt-level O0 crypto.c
uv run {baseDir}/ct_analyzer/analyzer.py --opt-level O3 crypto.c

VM-Compiled Languages (Java, Kotlin, C#)

# Analyze Java bytecode
uv run {baseDir}/ct_analyzer/analyzer.py CryptoUtils.java

# Analyze Kotlin bytecode (Android/JVM)
uv run {baseDir}/ct_analyzer/analyzer.py CryptoUtils.kt

# Analyze C# IL
uv run {baseDir}/ct_analyzer/analyzer.py CryptoUtils.cs

Note: Java, Kotlin, and C# compile to bytecode (JVM/CIL) that runs on a virtual machine with JIT compilation. The analyzer examines the bytecode directly, not the JIT-compiled native code. The --arch and --opt-level flags do not apply to these languages.

Swift (iOS/macOS)

# Analyze Swift for native architecture
uv run {baseDir}/ct_analyzer/analyzer.py crypto.swift

# Analyze for specific architecture (iOS devices)
uv run {baseDir}/ct_analyzer/analyzer.py --arch arm64 crypto.swift

# Analyze with different optimization levels
uv run {baseDir}/ct_analyzer/analyzer.py --opt-level O0 crypto.swift

Note: Swift compiles to native code like C/C++/Go/Rust, so it uses assembly-level analysis and supports --arch and --opt-level flags.

Prerequisites

Language	Requirements
C, C++, Go, Rust	Compiler in PATH (`gcc`/`clang`, `go`, `rustc`)
Swift	Xcode or Swift toolchain (`swiftc` in PATH)
Java	JDK with `javac` and `javap` in PATH
Kotlin	Kotlin compiler (`kotlinc`) + JDK (`javap`) in PATH
C#	.NET SDK + `ilspycmd` (`dotnet tool install -g ilspycmd`)
PHP	PHP with VLD extension or OPcache
JavaScript/

constant-time-analysis— agent skill

Is constant-time-analysis safe to install?

Constant-Time Analysis

When to Use

When NOT to Use

Language Selection

Quick Start

Native Compiled Languages Only (C, C++, Go, Rust)

VM-Compiled Languages (Java, Kotlin, C#)

Swift (iOS/macOS)

Prerequisites

Audit the pieces. Scan the whole. Decide.