Name: sast-jwt
Rating: 68 (1 reviews)
Author: utkusen

sast-jwt

Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

The canonical home for this skill is sast-jwt in utkusen/sast-skills

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable security skill with executable multi-language examples and a well-sequenced two-phase workflow. It loses points for re-explaining JWT basics Claude already knows and for being a large monolithic file that would benefit from splitting examples and output templates into reference files.

Suggestions

Move the per-language vulnerable/secure code examples and the Phase 1/Phase 2 output-format templates into files under references/ (e.g. references/language-examples.md, references/output-templates.md), keeping SKILL.md as an overview that links to them — this improves progressive disclosure and token efficiency.

Trim the 'What is an Insecure JWT Implementation' intro to drop the explanation of JWT structure (header.payload.signature, what claims are) that Claude already knows; keep only the vulnerability-specific framing.

Add a brief validate-then-fix note for the inter-phase gate so the workflow has an explicit feedback loop rather than a single forward checkpoint.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with concrete code and checks, but the 'What is an Insecure JWT Implementation' intro explains JWT structure (header.payload.signature, what claims are) that Claude already knows, and some prose around each vulnerability class restates the obvious. Could be tightened without losing the actionable detail.	3 / 5
Actionability	Fully executable guidance across Python/Node/Java/Go with copy-paste vulnerable-vs-secure snippets, specific library imports to search for, concrete jwt_tool/hashcat commands, and exact subagent prompt + output-format templates for both phases.	5 / 5
Workflow Clarity	Clear two-phase sequence with an explicit validation gate between phases ('read sast/jwt-recon.md; if JWT not used, skip Phase 2') and a Check 1–7 checklist for Phase 2. Not a 5 because there is no error-recovery feedback loop, though the operation is analytical rather than destructive.	4 / 5
Progressive Disclosure	Well-organized section structure, but the ~470-line body is monolithic with no bundle files and no references to separate files; the per-language examples and the two large output-format templates are inlined where splitting would aid navigation. No references are signaled because none exist.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does, when to use it, and its prerequisites and outputs. Trigger-term coverage is the only minor weakness, missing a few natural synonyms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'map all JWT issuance and verification sites' and 'check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation' — giving comprehensive coverage of the vulnerability classes.	5 / 5
Completeness	Explicitly answers both 'what' (two-phase detection of insecure JWT implementations with named weakness classes, prerequisites, and output path) and 'when' ('Use when asked to find JWT, token forgery, or authentication bypass bugs') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural keywords ('JWT', 'token forgery', 'authentication bypass') with a 'Use when...' trigger clause, but a few common synonyms ('token signing', 'auth bypass', 'JSON Web Token' as a standalone phrase) are not surfaced. Not a 5 because coverage is good rather than exhaustive.	4 / 5
Distinctiveness Conflict Risk	Targets a clear niche (JWT implementations specifically), declares a hard prerequisite ('Requires sast/architecture.md'), and uses distinct triggers unlikely to fire for unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.claude/skills/sast-jwt/SKILL.md
Commit: db52227

Reviewed: 14 minutes ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.