testing-jwt-token-security
From the author
Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.
Install
npx skills add 26zl/cybersec-toolkit --skill testing-jwt-token-security -a claude-code
Installs to .claude/skills/testing-jwt-token-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
Security85
Provenance63
Maintenance100
Licence100
Adoption33
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- JWT Security TestingPramodDutta/qaskillsComprehensive JWT token security testing including signature verification, expiration checks, algorithm confusion attacks, and claim validation.Security★ 240
- exploiting-websocket-vulnerabilities26zl/cybersec-toolkitTesting WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.Security★ 82
- jwta5c-ai/babysitterJWT implementation, token management, refresh patterns, and security.Security★ 1.9K
- jwt-securityMindrally/skillsGuidelines for implementing JWT authentication with security best practices for token creation, validation, and storageSecurity★ 286
- api-authenticationsecondsky/claude-skillsSecure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers, auth flow errors.Engineering★ 236
- offensive-jwtSnailSploit/Claude-RedJWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.Security★ 9K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in