jwt-auth
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill content.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill correctly identifies the need for a
JWT_SECRET_KEYand suggests managing it via environment variables. It does not contain any hardcoded secrets or sensitive credentials. - [COMMAND_EXECUTION]: The provided
scripts/verify.pyis a standard utility script for validating theSKILL.mdformat (YAML frontmatter and naming conventions). It operates only on local skill files and does not perform network operations or execute arbitrary commands. - [INDIRECT_PROMPT_INJECTION]: While the skill provides templates for processing tokens, it does not ingest untrusted data in a way that creates an injection vulnerability within the agent's own execution context.
- [SAFE]: The documentation follows security best practices for JWT, such as recommending HS256, short expiration times, and secret management.
Audit Metadata