testing-jwt-token-security

SUSPICIOUS. The skill’s behavior is internally aligned with its stated purpose as a JWT penetration-testing guide, but that purpose is itself an offensive security capability for an AI agent. No credential theft, covert exfiltration, or deceptive third-party proxying is present. Main risk comes from enabling exploitation workflows and from relying on a personally published security tool with mixed install provenance.

This module is not a typical benign library; it is an offensive/active JWT security testing tool. It forges JWTs (including alg=none-style attempts), brute-forces HMAC secrets from a wordlist, and sends forged/expired tokens to a target URL to test for authorization bypass and weak revocation. While it is appropriate for authorized security testing, it is high-risk if published/deployed in unintended contexts and could be readily repurposed for malicious authentication attacks. No clear obfuscation is present, and there is no evidence of stealth/persistence or malware behavior beyond its intended attack capabilities.