The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to download jwt_tool from GitHub (https://github.com/ticarpi/jwt_tool.git). This is an industry-standard toolkit for JWT vulnerability research and auditing.
[COMMAND_EXECUTION]: The workflow describes the use of standard command-line tools including openssl for key extraction, hashcat and john (John the Ripper) for secret brute-forcing, and package management commands (pip install, git clone) to set up the testing environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of JWT tokens which are parsed and analyzed. While this represents an ingestion surface for untrusted data, the included agent.py utility acts as a passive analyzer and active tester against external targets rather than an autonomous decision-maker, which minimizes the risk of indirect injection.

testing-for-json-web-token-vulnerabilities