competition-jwt-claim-confusion

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Quality

100%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is a well-structured, concise investigative workflow with concrete checklists and a properly signaled single reference file. It assumes Claude's knowledge, gives actionable domain-specific guidance, and keeps the detailed checklist one level deep in the reference.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence, listing concrete fields and steps without explaining what JWT/JWS/JWE are; every section earns its tokens. It is not the level-2 case of padded or unnecessary explanation.	3 / 3
Actionability	Provides concrete, specific guidance (header fields like `alg`, `kid`, `jku`; claim types; a token-supplied->parser->claim-accepted->capability reduction). For an instruction-only analytical skill the actionable guidance is specific and copy-applicable rather than abstract.	3 / 3
Workflow Clarity	A clear 5-step Quick Start plus a 3-phase workflow with explicit checklists and a verification step ('Reproduce the smallest token-to-acceptance flow that proves the decisive confusion'). The destructive/batch feedback-loop cap does not apply to this investigative skill.	3 / 3
Progressive Disclosure	The body is an overview that signals one real, one-level-deep reference ('Load `references/jwt-claim-confusion.md` ...'), which exists in the bundle; navigation is clear and content is appropriately split.	3 / 3
	Total	12 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, and complete, clearly stating both capability and activation conditions while staying tightly scoped to its downstream CTF-sandbox JWT niche. It avoids vague language and uses appropriate third-person trigger phrasing.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs'), matching the score-3 anchor for comprehensive specific actions.	3 / 3
Completeness	Explicitly answers both what (the validation-path workflow) and when ('Use when the user asks to inspect JWT headers or claims...'), satisfying the explicit-trigger requirement.	3 / 3
Trigger Term Quality	Includes natural user-facing terms ('inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims') with good coverage of how a user would phrase the request.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear narrow niche (JWT claim confusion within the ctf-sandbox-orchestrator routing) with distinct triggers and an explicit routing precondition, making conflict with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zhaoxuya520/reverse-skill
Path: CTF-Sandbox-Orchestrator/competition-jwt-claim-confusion/SKILL.md
Commit: 6aa1362

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.