The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various external security tools (e.g., jwt_tool, hashcat, nuclei) via the shell to automate vulnerability scanning and token forgery.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting untrusted JWT tokens from external application responses and passing them as arguments to shell commands.
Ingestion points: JWT tokens are extracted from Login/token responses, Set-Cookie headers, and Authorization headers as described in SKILL.md.
Boundary markers: The instructions do not specify any delimiters or warnings to ignore potentially malicious content embedded within the token strings.
Capability inventory: The skill uses shell execution for jwt_tool, hashcat, and nuclei, and supports Python script execution for PyJWT logic.
Sanitization: There is no mention of sanitizing or validating the token string before it is interpolated into shell command templates like jwt_tool <token> -X a.
[DYNAMIC_EXECUTION]: The skill suggests creating and running small Python scripts using the PyJWT library to perform custom token forgery and signing tasks.

hunt-jwt-crypto