testing-for-json-web-token-vulnerabilities

SUSPICIOUS. The skill is internally coherent for a JWT penetration-testing purpose, but its purpose itself is to give an AI agent offensive security capability: token forgery, brute forcing, SSRF-style header abuse, and authentication bypass. Install sources are partly verifiable and not overtly malicious, so malware confidence stays moderate-low, but the overall security risk is high because this skill enables exploit activity and real-world attacks against targets.

No clear obfuscation or stealth/persistence behavior is present. However, the module is clearly designed for offensive JWT testing: it crafts alg=none variants, attempts weak HMAC secrets using a common secret list, and (optionally) sends forged tokens to a target endpoint (/users/me) via HTTP Authorization headers. While it may be intended for penetration testing, its capabilities (signature bypass testing and secret guessing/exploitation) make it risky in a supply-chain context and potentially malicious when used against systems without authorization.