testing-jwt-token-security

75 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By yanacuti1121/Yana-AI (GitHub) · coding · 13 stars · scanned at commit 54d4aa9

Assessing JSON Web Token implementations for cryptographic weaknesses,

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 4 places.

.claude/skills/testing-jwt-token-security/SKILL.md, line 47- **jwt_tool**: JWT attack toolkit (`pip install jwt_tool` or `git clone https://github.com/ticarpi/jwt_tool.git`)
.claude/skills/testing-jwt-token-security/SKILL.md, line 49- **Python PyJWT**: For scripting custom JWT attacks (`pip install pyjwt`)
.claude/skills/testing-jwt-token-security/SKILL.md, line 50- **Hashcat**: For brute-forcing HMAC secrets (`apt install hashcat`)

Show 1 more

.claude/skills/testing-jwt-token-security/references/api-reference.md, line 7pip install PyJWT

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 6 places.

.claude/skills/testing-jwt-token-security/SKILL.md, line 62JWT="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
.claude/skills/testing-jwt-token-security/SKILL.md, line 89python3 jwt_tool.py "$JWT" -X a
.claude/skills/testing-jwt-token-security/SKILL.md, line 125curl -s "https://target.example.com/.well-known/jwks.json" | jq .

Show 3 more

.claude/skills/testing-jwt-token-security/SKILL.md, line 170python3 jwt_tool.py "$JWT" -C -d /usr/share/wordlists/rockyou.txt
.claude/skills/testing-jwt-token-security/SKILL.md, line 203python3 jwt_tool.py "$JWT" -T -S hs256 -p "known_secret" \
.claude/skills/testing-jwt-token-security/SKILL.md, line 235python3 << 'PYEOF'

Sends data to these websites: target.example.com

The author does not mention this.

Found in 14 places.

.claude/skills/testing-jwt-token-security/SKILL.md, line 103curl -s -H "Authorization: Bearer $FORGED_JWT" \
.claude/skills/testing-jwt-token-security/SKILL.md, line 111curl -s -o /dev/null -w "%{http_code}" \
.claude/skills/testing-jwt-token-security/SKILL.md, line 125curl -s "https://target.example.com/.well-known/jwks.json" | jq .

Show 11 more

.claude/skills/testing-jwt-token-security/SKILL.md, line 126curl -s "https://target.example.com/.well-known/openid-configuration" | jq .jwks_uri
.claude/skills/testing-jwt-token-security/SKILL.md, line 127curl -s "https://target.example.com/oauth/certs" | jq .
.claude/skills/testing-jwt-token-security/SKILL.md, line 160curl -s -H "Authorization: Bearer $FORGED_TOKEN" \
.claude/skills/testing-jwt-token-security/SKILL.md, line 251curl -s -H "Authorization: Bearer $EXPIRED_TOKEN" \
.claude/skills/testing-jwt-token-security/SKILL.md, line 272curl -s -H "Authorization: Bearer $PRE_LOGOUT_TOKEN" \
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 69resp = requests.get(target_url, headers={"Authorization": f"Bearer {forged}"},
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 136resp = requests.get(target_url, headers={"Authorization": f"Bearer {token}"},
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 155pre = requests.get(target_url, headers=headers, timeout=10, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true") # Set SKIP_TLS_VERIFY=true for
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 159requests.post(logout_url, headers=headers, timeout=10, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true") # Set SKIP_TLS_VERIFY=true for self-
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 160post = requests.get(target_url, headers=headers, timeout=10, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true") # Set SKIP_TLS_VERIFY=true for
.claude/skills/testing-jwt-token-security/scripts/agent.py, line 181resp = requests.get(url, timeout=10, verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true") # Set SKIP_TLS_VERIFY=true for self-signed certs in la

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'testing-jwt-token-security' ] || [ -L ~/.agents/skills/'testing-jwt-token-security' ]; then echo 'A skill folder named testing-jwt-token-security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/yanacuti1121/Yana-AI' "$d" && git -C "$d" checkout --quiet '54d4aa9fa3241319f4d37212bd23826658bf6bed' -- '.claude/skills/testing-jwt-token-security' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/testing-jwt-token-security' ~/.agents/skills/'testing-jwt-token-security' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'testing-jwt-token-security' ~/.claude/skills/'testing-jwt-token-security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for yanacuti1121/Yana-AI shows the score of its lowest-scoring skill.

SkillTrust badge for yanacuti1121/Yana-AI

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/yanacuti1121/Yana-AI.svg)](https://zalavijaysinh.github.io/skilltrust/repos/yanacuti1121/Yana-AI/)

Score history

Date	Version	Score
2026-11-13	`54d4aa9`	75
2026-11-08	`4a78f20`	75

Also found in

Identical copies of this skill exist at:

yanacuti1121/Yana-AI/core/skills/testing-jwt-token-security