testing-jwt-token-security
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and prerequisites require the installation of external security tools and libraries, including
jwt_toolfrom a GitHub repository, thepyjwtPython library, and thehashcatutility. These are standard tools in the cybersecurity domain.\n- [COMMAND_EXECUTION]: The skill workflow involves executing shell commands and Python scripts to perform security testing. This includes the use ofcurlfor API interaction,python3for running local tools and custom attack scripts, andhashcatfor cryptographic brute-forcing.\n- [DATA_EXFILTRATION]: The skill provides example URLs for testing JWT injection attacks, specificallyhttps://attacker.example.com/jwks.jsonandhttps://attacker.example.com/cert.pem. These represent attacker-controlled infrastructure for hosting malicious keys or certificates and were flagged by automated phishing scanners, although they utilize the reservedexample.comdomain.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata