tls-config-drift

What this is for

TLS configuration drifts silently: a developer adds TLS_RSA_WITH_RC4_128_SHA to a cipher array, pins the wrong public-key fingerprint, or forgets rejectUnauthorized in an mTLS setup. security-smell-scanner flags generic "use TLS 1.2+" - no tool reads the actual cipher suites and cert-pin values and classifies each as acceptable vs downgrade-risk. This skill catalogs every TLS-relevant statement, and the LLM classifies each by drift-type.

PROTECTION RULE - never ~/.claude/

Read-only skill. Guard required if write mode added later.

## What You Must Do When Invoked

During analysis, assign a confidence level to each finding: proven (confirmed by evidence), likely (strong signal, needs review), or suspected (weak signal).

Step 1

If -help is passed, print the ## Usage block below and stop.

Step 2

Confirm -ProjectDir is provided and the path exists.

Step 3

Run: scripts/tls-config-scan.ps1 -ProjectDir "<path>"

Step 4

LLM reads the JSON output. For each finding:

Step 5

TLS version: is it TLSv1.2+ (acceptable) or TLSv1/TLSv1.1 (deprecated)?

Step 6

Cipher suite array: any NULL-cipher, RC4, CBC-SHA, or export-grade suite? Is the array restrictive or overly permissive?

Step 7

Cert pinning: is the fingerprint correct for the current certificate? Is HPKP used (deprecated/dangerous)?

Step 8

mTLS: is rejectUnauthorized set to true? Is requestCert paired with ca?

Step 9

Cert validation: does checkServerIdentity bypass checks? Is a custom validator weakening security?

Step 10

FIPS mode: is it explicitly enabled? Is it consistent across the project?

Step 11

Downgrade risk: if a config element is missing (e.g., no minVersion), what is the implicit default?

Step 12

Severity scale: FIPS-disabled > weak pin > TLSv1.1 > TLSv1.2 with wide cipher > missing mTLS flag.

Step 13

Write tls-config-drift-report.md to the working directory.

Usage

/ssl-drift                              # interactive
/ssl-drift <dir>                        # scan project
/ssl-drift -help                        # show usage

Returns JSON with findings[]: {file, line, findingType, lineContent} plus summary counts.