jwt-attacks
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed guidance for auditing JSON Web Token (JWT) implementations across multiple languages. All content is educational and diagnostic. No malicious patterns such as exfiltration or unauthorized access were detected.
- [COMMAND_EXECUTION]: The skill includes shell command examples in SKILL.md and poc-skeleton.md using 'grep' and security auditing tools like 'hashcat' and 'jwt_tool'. These are standard practices for security analysis and are not automated by the skill itself.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code through manual or suggested search commands. 1. Ingestion point: Source code searching via 'grep' (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: File reading and shell search commands. 4. Sanitization: Absent. The risk is assessed as safe/minimal because the skill focuses on providing search patterns and manual auditing steps rather than automated execution paths.
- [REMOTE_CODE_EXECUTION]: No remote code execution or automated downloading patterns were detected. The Python snippets provided in references/poc-skeleton.md are static examples for manual use and import standard libraries like PyJWT and cryptography.
Audit Metadata