hunt-jwt-crypto

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with concrete commands, a clearly sequenced escalation workflow, and explicit validation discipline. Its only weakness is mild verbosity in the conceptual intro that restates JWT basics Claude already knows.

Suggestions

Trim the 'What actually pays' opening: drop the generic explanation that a JWT is 'header.payload.signature' and that the signature prevents tampering, since Claude already knows JWT structure; lead instead with the two verifier flaws and impact.

Avoid restating each forge concept twice: the alg:none and key-confusion explanations appear both in 'What actually pays' and again in 'Forging the token' — consolidate so each technique is described once alongside its command.

Consider moving the secondary techniques (kid and jku/x5u header injection) into a short reference file so the main flow stays focused on the alg:none / key-confusion primary path, improving token efficiency on first load.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and operational, but the 'What actually pays' intro explains JWT structure and the alg:none / key-confusion concepts that Claude already knows, and those concepts are then re-stated as commands in 'Forging the token', adding some padding.	2 / 3
Actionability	Provides fully executable, copy-paste-ready guidance: jwt_tool flags ('-T', '-X a', '-X k -pk public.pem'), concrete header/payload JSON, kid path-traversal payloads, and exact escalation endpoints like '/admin/delete?username='.	3 / 3
Workflow Clarity	Clear sequence (Recon -> Forge -> Drive to admin -> Proof of impact -> Validation) with explicit validation checkpoints and error-recovery feedback loops ('A 401 on /admin means... change ONE thing and retry'), appropriate for destructive forge operations.	3 / 3
Progressive Disclosure	Single focused SKILL.md with no external bundle files needed; content is well-organized into clearly headed sections (What actually pays, Recon, Forging the token, Drive to ADMIN objective, Proof of impact, Validation discipline) giving easy navigation for a single-task hunting skill.	3 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, complete on both what and when, and clearly distinguished from sibling skills. It uses third-person voice throughout and avoids vague fluff. No changes needed.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'alg:none signature-stripping', 'RS256->HS256 key-confusion', 'kid/jku header injection', and 'forge a token for any identity', matching the anchor for multiple specific concrete actions.	3 / 3
Completeness	Explicitly answers both what ('Hunt JWT cryptographic failures... forge a token for any identity') and when ('Use when the app authenticates with a JSON Web Token...'), with a clear 'Use when' trigger clause.	3 / 3
Trigger Term Quality	Covers natural terms a user would say when needing this skill: 'JWT', 'JSON Web Token', 'eyJ... Bearer token', 'Authorization header', 'cookie', and 'login response', with good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	Explicitly carves a clear niche ('This skill OWNS JWT signature/crypto forgery') and distinguishes it from hunt-ato, hunt-auth-bypass, and hunt-api-misconfig, making wrong-skill triggering unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-jwt-crypto/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.