sast-jwt

Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced security skill with concrete code, checks, and a gating checkpoint between phases. Its main weaknesses are verbosity from re-explaining known concepts and a monolithic structure with no progressive disclosure of the long prompt/template content.

Suggestions

Move the large Phase 1/Phase 2 subagent prompt and output-template blocks into reference files (e.g. references/phase1-recon.md) referenced one level deep, keeping SKILL.md a concise overview.

Trim explanations of concepts Claude already knows (e.g., the 'JWTs consist of three Base64URL-encoded parts' paragraph and textbook descriptions of each vulnerability class) down to the distinguishing criteria Claude needs to apply.

Consolidate the Important Reminders section, which repeats guidance already stated in the vulnerability class definitions and execution phases.

Dimension	Reasoning	Score
Conciseness	The body is efficient in its actionable parts but restates concepts Claude already knows (e.g., 'JWTs consist of three Base64URL-encoded parts: header.payload.signature' and textbook explanations of each vuln class) and the Important Reminders section reiterates earlier material, so it could be tightened rather than fully lean.	2 / 3
Actionability	Provides executable vulnerable/secure code in Python/Node/Java/Go, concrete per-site check lists, full subagent prompts with copy-ready output templates, and exact dynamic-test commands (jwt_tool, hashcat), all copy-paste ready.	3 / 3
Workflow Clarity	The two-phase process is clearly sequenced with an explicit gating checkpoint ('After Phase 1 completes, read jwt-recon.md. If... not used, skip Phase 2 entirely') and a defined classification scheme, giving a clear sequence with validation steps.	3 / 3
Progressive Disclosure	No bundle files exist (references/scripts/assets absent) and the skill is a single ~470-line monolithic SKILL.md with the large subagent prompt templates and vulnerability taxonomy all inline rather than split into clearly signaled one-level-deep references.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that concretely states capabilities, gives explicit use-when triggers, and is clearly scoped to a distinct niche. Voice is third person throughout with no over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions: 'map all JWT issuance and verification sites', 'check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation', matching the highest anchor.	3 / 3
Completeness	Clearly answers both what it does (two-phase insecure-JWT detection with prerequisite and output file) and when to use it via the explicit 'Use when asked to find...' clause, so it is not capped at 2.	3 / 3
Trigger Term Quality	Includes natural user-facing terms in the trigger clause ('JWT, token forgery, or authentication bypass bugs') with the acronym also spelled out once as 'JSON Web Token', giving good coverage of phrases a user would actually say.	3 / 3
Distinctiveness Conflict Risk	The JWT-specific niche, distinct triggers, and stated prerequisite (sast/architecture.md) make it clearly distinguishable and unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-jwt/SKILL.md
Commit: db52227

Reviewed: about 20 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.