jwt-attacks

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt repeatedly instructs the agent to embed real JWTs, HMAC secrets/public keys and cracked keys verbatim into commands, code and headers (e.g., jwt_tool calls, jwt.encode examples, kid/jku/x5u injections), which forces the LLM to handle and output sensitive tokens/credentials directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). Yes — the list contains attacker-controlled JWKS/CRTs, URL-obfuscation and redirect patterns (jku fragments, redirects, host@path, query tricks) alongside exploit-oriented GitHub tools, all of which are classic indicators of a suspicious/malicious download or hosting setup used to deliver malicious keys/payloads or enable SSRF/JWT attacks.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an offensive exploitation guide that deliberately instructs how to forge JWTs, steal/replace signing material, trigger server-side HTTP fetches (SSRF), perform header-based injections (kid/jwk/jku/x5u) and even command-injection/vectorized key confusion to achieve privilege escalation, credential theft, and potential remote code execution — i.e., high-risk malicious behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly depends on and invokes external tooling fetched/executed at runtime—most notably jwt_tool referenced at https://github.com/ticarpi/jwt_tool (and a Docker pull of ttervoort/jws2pubkey) which would download and run remote code required for the attacks.