hunt-jwt-crypto

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-signal hunting playbook: concrete commands and token templates for each forgery class, a clear escalation workflow with validation feedback loops, and well-structured sections. Minor gains available from trimming introductory JWT framing and optionally splitting the technique catalog into a reference file.

Suggestions

Trim the JWT-structure primer in 'What actually pays' to a one-line reminder; Claude already knows the header.payload.signature layout.

Consider moving the per-technique forging catalog (kid/jku/x5u/jwk/expiry/cross-tenant) into a references file, keeping SKILL.md as the recon + escalation overview with one-level-deep links.

In the kid/jku sections, a one-line note on how to confirm the verifier actually resolves the attacker-controlled value (vs. silently ignoring it) would sharpen the validation loop.

Dimension	Reasoning	Score
Conciseness	Mostly lean and dense with actionable techniques, but a few framing sentences (e.g. 'The signature is the only thing stopping you from editing the payload...') restate JWT basics Claude already knows and could be trimmed.	4 / 5
Actionability	Provides copy-paste-ready commands (jwt_tool `-X a`, `-X k -pk public.pem`, hashcat `-m 16500`, nuclei `-t jwt/`) and concrete header/payload JSON for every forging variant, covering the common cases fully.	5 / 5
Workflow Clarity	Sequences recon → forge → escalate → prove, with a fixed numbered escalation order, an explicit 401 → change-one-thing feedback loop, and a dedicated 'Validation discipline' section — destructive operations carry explicit checkpoints.	5 / 5
Progressive Disclosure	Well-organized with clear ## sections and content appropriately placed inline for a hunting skill, though the catalog of forging techniques (kid/jku/jwk/expiry/cross-tenant) is long enough it could partially externalize to a reference file.	4 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tightly written description that covers what, when, and the critical trigger surface, while explicitly distinguishing the skill from neighboring JWT-related skills. It is concrete, third-person, and free of vague fluff.

Dimension	Reasoning	Score
Specificity	Names multiple concrete forgery actions — 'alg:none signature-stripping', 'RS256→HS256 key-confusion', 'kid/jku header injection' — giving comprehensive coverage of the crypto-failure class.	5 / 5
Completeness	Explicitly answers both 'what' (hunt/forge JWT crypto failures) and 'when' ('Use when the app authenticates with a JSON Web Token...') with concrete trigger phrases, plus a criticality condition.	5 / 5
Trigger Term Quality	Covers natural terms and synonyms a user would say — 'JSON Web Token', 'JWT', the `eyJ...` prefix, 'Bearer token in the Authorization header', 'cookie', and 'login response'.	5 / 5
Distinctiveness Conflict Risk	Declares a clear niche ('This skill OWNS JWT signature/crypto forgery') and explicitly carves out adjacent skills (hunt-ato, hunt-auth-bypass, hunt-api-misconfig), minimizing trigger conflict.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-jwt-crypto/SKILL.md
Commit: d4b54e1

Reviewed: 7 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.