Skill

testing-for-json-web-token-vulnerabilities

skill:mukul975/anthropic-cybersecurity-skills#testing-for-json-web-token-vulnerabilities

Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or SSO systems during a security engagement.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:17 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

63/67

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/testing-for-json-web-token-vulnerabilities:skills/testing-for-json-web-token-vulnerabilities/SKILL.md:61:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill's setup instructions direct the agent to clone the jwt_tool repository at a mutable, unpinned git ref and pip-install PyJWT without a version pin before executing the cloned tool, so whatever code sits at those locations at runtime runs on the tester host.

skills/testing-for-json-web-token-vulnerabilities/SKILL.md:61

git clone https://github.com/ticarpi/jwt_tool.git

vector:instruction

Counter-argument considered

Both directions weighed: the description names jwt_tool as a declared tool, but the accepted carve-outs cover only pinned official-registry installs and vendor installers, while the skill body concretely instructs an unpinned `pip install pyjwt`, a mutable default-branch `git clone` of jwt_tool, and immediate execution of the cloned `python3 jwt_tool.py`, so whatever upstream holds at runtime runs on the tester host — an accurate, undeclared supply-chain instruction that survives all gates.

Open questions 1

What the analysis could not settle from the code alone.

No mechanism in the shown units verifies that the operator is authorized to test the --url/target host; authorization is asserted only by textual disclaimers, so whether the forged-token network sends and documented attacks run against an authorized target cannot be settled from the artifact.

Coverage gaps 5

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:e13892c252993eb6

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:ca61d3136b8d0d30

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:ac0ebd767dd4e93b

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:022a00680004bfb6

invalid_judge_finding behavior-chains.0