The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents common command-line examples for legitimate security tools such as jwt_tool, hashcat, and nuclei. These are provided as educational examples for manual testing and are not executed automatically by the skill.
[PROMPT_INJECTION]: The skill uses phrases like 'IMPORTANT' and 'CRITICAL' in a purely instructional context to highlight high-value security findings. There are no attempts to override agent behavior, bypass safety filters, or extract system prompts.
[DATA_EXFILTRATION]: There are no commands or instructions that access sensitive local files (like SSH keys or AWS credentials) or exfiltrate data to external servers. The network operations discussed (e.g., Nuclei scanning) are standard for security auditing targets.
[EXTERNAL_DOWNLOADS]: The skill mentions external tools (jwt_tool, hashcat, nuclei) and target endpoints (e.g., /.well-known/jwks.json), but it does not perform any unverified downloads or remote script execution.
[OBFUSCATION]: No obfuscated content, base64-encoded commands, zero-width characters, or homoglyphs were detected. The use of JWT strings (eyJ...) is standard for documenting the protocol.
[INDIRECT_PROMPT_INJECTION]: As a static guidance file, it does not ingest untrusted runtime data that could lead to indirect injection. It provides a structured methodology for auditing JWT implementations.

hunt-jwt-crypto