jwt

JSON Web Token attacks — algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/exploit/web/jwt/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, actionable attack reference with strong executable command coverage and a clear PoC workflow including a validation step. It is slightly above the lean-tokens ideal and could offload reference material into bundle files for better progressive disclosure.

Suggestions

Trim historical commentary ('pre-2017', bounty dollar ranges, CVE-era notes) or move it into a dedicated 'Historical exemplars' reference file to improve token efficiency.

Split the severity-calibration table and Known exemplars into a `references/severity.md` / `references/exemplars.md` and link them one level deep from the body to strengthen progressive disclosure.

Add an explicit fix-and-retry feedback loop to the PoC workflow (e.g. 'if a test is negative, vary claims/kid and re-run') to push workflow clarity toward 5.

Dimension	Reasoning	Score
Conciseness	Mostly lean, bullet-driven prose that assumes Claude's competence (one-line anatomy, direct command snippets), with minor over-explanation such as the historical 'Worked on auth0 / pyjwt / many home-rolled libs pre-2017' commentary that could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready, executable commands throughout — `jwt_tool -X a/-X k/-X i`, `hashcat -m 16500`, `john --format=HMAC-SHA256`, curl+jq JWKS fetch, and concrete Node/Python verify snippets — covering the common cases fully.	5 / 5
Workflow Clarity	Section 4 gives a clear 4-step PoC sequence (capture → run all tests → replay to confirm → document) with a validation checkpoint ('replay manually via Burp Repeater to confirm'), satisfying the destructive/batch validation floor; minor gap is the lack of an explicit fix-and-retry feedback loop.	4 / 5
Progressive Disclosure	Well-organized into numbered sections (Anatomy, Attack surface, Detection, PoC, Severity, Remediation) with a Cross-references block, but at ~131 lines some inline material (the severity table, Known exemplars) could be split into reference files; no bundle files exist to offload detail.	4 / 5
	Total	17 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-scoped description that clearly delineates the JWT attack domain with concrete techniques. Its main gap is the absence of an explicit 'Use when...' trigger clause, which limits the completeness score.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing authentication that uses JWTs/bearer tokens, or when the user mentions JWT, alg=none, kid, or JWKS endpoints.'

Include natural synonyms users say ('bearer token', 'token forgery', 'token bypass') alongside the technical terms to broaden trigger coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete attack actions — 'algorithm confusion (alg=none, HS256↔RS256), kid header injection, JWKS spoofing, weak HMAC secret cracking, signature stripping' — giving comprehensive coverage of the JWT attack surface.	5 / 5
Completeness	The 'what' is clearly stated (the enumerated attack classes), but there is no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Includes natural terms a user would say ('JSON Web Token attacks') and accurate domain keywords (alg=none, kid, JWKS), but omits common natural variations like 'bearer token' or 'token forgery' that a user might phrase.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear, narrow niche (JWT-specific attacks) with distinct technical triggers and minimal overlap risk with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/jwt/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.