Skill

testing-jwt-token-security

skill:mukul975/anthropic-cybersecurity-skills#testing-jwt-token-security

Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:45 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

97/103

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/testing-jwt-token-security:skills/testing-jwt-token-security/SKILL.md:44:SUPPLY
suspicious: unverified finding skill:skills/testing-jwt-token-security:skills/testing-jwt-token-security/scripts/agent.py:1:PRIVESC

Security findings 2

Privilege escalation

mediumUnverifiedmedium confidence

The skill's bundled agent.py carries repeated conditional instructions to set SKIP_TLS_VERIFY=true, disabling TLS certificate verification for the tool's outbound requests (which carry the tokens under test) whenever the target uses self-signed certificates, weakening transport security during operation.

skills/testing-jwt-token-security/scripts/agent.py:1-193

Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments

trigger:conditionalvector:codevector:instruction

Supply chain

mediumContextual risklow confidence

The skill's Prerequisites section instructs installing the jwt_tool toolkit by cloning an unpinned GitHub repository, so the code installed at setup time comes from a mutable remote that could change between runs.

skills/testing-jwt-token-security/SKILL.md:44

git clone https://github.com/ticarpi/jwt_tool.git

vector:instruction

Counter-argument considered

The unpinned, non-registry git clone instruction is real and reaches the agent, and although D3 openly declares the install (so undeclared fails and no concealment is alleged), disclosure does not neutralize a mutable-remote supply risk and no accepted carve-out (pinned official-registry installs, vendor installers) covers an unpinned git clone, so the low-severity finding stands.

Open questions 3

What the analysis could not settle from the code alone.

The SKILL.md frontmatter tags MITRE techniques T1505.003 (Web Shell) and T1083 (File and Directory Discovery) that do not correspond to any JWT testing content shown in this pass; do other files of the skill implement capabilities matching these tags?

Reconnaissance

[file request skills/testing-jwt-token-security/scripts/agent.py] Show the full implementation of scripts/agent.py (the decoded unit covers only lines 1-193 while the file extends past line 223): how is the SKIP_TLS_VERIFY environment variable applied to outbound requests, what do lines 194 to the end contain, and does any help text or printed output steer the agent beyond JWT testing?

Privilege escalation

[file request skills/testing-jwt-token-security/jwt_tool.py] SKILL.md repeatedly instructs running `python3 jwt_tool.py` with attack flags (-X a, -X k, -X s, -C, -I, -T); does this artifact ship jwt_tool.py, and if so what does that script execute?

Code execution

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

criticalRefutedlow confidence

SKILL.md instructs the agent to run curl commands that transmit forged and test JWTs in Authorization headers to the engagement target placeholder target.example.com; this is documented attack traffic against the declared target, not exfiltration of user or host data.

skills/testing-jwt-token-security/SKILL.md:101

https://target.example.com/api/admin/users

Why it was refuted

The flagged traffic sends tokens the agent forged itself to the authorized engagement-target placeholder, which is the skill's declared core activity and a documented attack payload in security-education material, not exfiltration of user or host data; both the harm carve-out and the declared authorized-engagement context kill the finding.

Coverage gaps 11

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:ebc5ca1024116002

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:444f931d995a2021

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:1ba76046d3c82c41

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:19d1df3980aa9a5f

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:015cc735f24395cd

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:2c15ae9b14e033a5

invalid_judge_finding behavior-chains.0

request_unanswered request.0: instruction-surface.0/agent-py-remainder: finding: no valid finding cites the answer's evidence

request_unanswered request.0: behavior-chains.0/req-jwt-tool-src: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.0

invalid_refuter refuter results do not match requested findings