skills/mukul975/anthropic-cybersecurity-skills/implementing-jwt-signing-and-verification/Gen Agent Trust Hub
implementing-jwt-signing-and-verification
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and displays content from external JWT tokens, which constitutes an indirect prompt injection surface. 1. Ingestion points:
scripts/agent.py(via--audit,--verify, and--decode) andscripts/process.py(via--token). 2. Boundary markers: Absent; decoded token data is presented to the agent without specific delimiters or isolation instructions. 3. Capability inventory: The scripts possess the capability to write report files and cryptographic keys to the local file system. 4. Sanitization: The scripts perform standard parsing (JSON/Base64) but lack semantic sanitization of claim content before presentation to the agent. - [METADATA_POISONING]: The skill documentation contains conflicting author information, citing 'mahipal' in
SKILL.mdand 'mukul975' in theLICENSEfile.
Audit Metadata