exploiting-jwt-algorithm-confusion-attack

High-risk offensive security skill. Its capabilities are internally consistent with its stated purpose, but that purpose is to help an AI agent conduct JWT auth bypass and token forgery against target systems. No strong malware or obfuscation signs appear, yet the exploit functionality and partial reliance on third-party security tooling make it dangerous.

This is a dual-use JWT security-testing script containing explicit token-forging functionality for alg:none and HS256/RSA algorithm-confusion tests. Those capabilities could be misused against vulnerable JWT implementations, but the code itself performs no network attacks, unauthorized access, data exfiltration, persistence, or system damage. It should be restricted to authorized testing, and the fragment requires a closing parenthesis for main() to run.