jwt-attacks

SUSPICIOUS: the skill is internally coherent as a JWT security-audit guide and shows no credential exfiltration, installer abuse, or third-party routing. However, it gives an AI agent offensive security review capability focused on identifying exploitable auth flaws, which is high-risk by category even though the footprint is otherwise local and proportionate.

High confidence this fragment is offensive PoC code intended to forge or bypass JWT authentication/authorization. While it does not show persistence, system compromise, or network exfiltration, it meaningfully enables unauthorized access attempts by generating forged tokens (including unsigned/alg=none variants), misusing keys for algorithm-confusion, and testing kid/JWK header-based key trust and traversal-like behaviors, with guidance to brute-force signing secrets. If present in a dependency/package, treat as a serious supply-chain risk and do not execute it in production contexts.