jwt-backend
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides defensive security guidance for implementing authentication, specifically recommending against the 'alg: none' vulnerability and advocating for explicit algorithm allowlisting.
- [SAFE]: The implementation templates follow industry best practices for secure token management, including access/refresh token separation, refresh token rotation with theft detection, and mandatory claim validation (iss, aud, exp).
- [SAFE]: Secure storage recommendations are provided, correctly identifying the risks of localStorage and advocating for HttpOnly cookies and platform-specific secure storage (Keychain, EncryptedSharedPreferences).
- [SAFE]: No prompt injection, data exfiltration, obfuscation, or malicious command execution patterns were detected.
Audit Metadata