The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Node.js and Python to perform cryptographic verification of tokens. It correctly implements security controls by passing tokens and secrets through environment variables (JWT_TOKEN, JWT_SECRET) rather than command-line arguments to prevent leakage in process lists or shell history.
[EXTERNAL_DOWNLOADS]: The skill attempts to verify the presence of the jose library and provides a command to install it via npm install -g jose if it is missing. This is a standard dependency for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of JWT payloads. While there is a risk that a payload could contain instructions intended to influence the agent when it prints the result, the skill's focus on structured reporting and signature verification significantly mitigates this surface.
Ingestion points: JWT header and payload content provided by the user.
Boundary markers: The output is constrained to a specific 'JWT Validation Report' format.
Capability inventory: Executes shell commands (node/python) and can make network requests to fetch JWKS endpoints.
Sanitization: The skill relies on standard library parsing (jose or PyJWT) and structured JSON output to handle the data.

jwt-validate