jwt-security
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive and accurate security guidelines for JWT implementation.
- [SAFE]: Code examples correctly demonstrate security best practices, such as whitelisting algorithms, validating all standard claims (exp, iss, aud, sub), and using asymmetric signing.
- [SAFE]: The documentation explicitly warns against and provides mitigations for common vulnerabilities like algorithm confusion, the 'none' algorithm attack, and weak HMAC secrets.
- [SAFE]: It correctly advises against storing sensitive data in JWT payloads and emphasizes secure token storage (e.g., HttpOnly cookies) and transmission (Authorization headers).
- [SAFE]: The skill includes advanced security patterns such as refresh token rotation, token revocation lists (using JTI), and key rotation support via JWKS.
- [SAFE]: All external references and metadata point to the author's official GitHub repository (Mindrally), which is consistent with the skill's purpose.
Audit Metadata