The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install the jwt_tool utility from an external GitHub repository (github.com/ticarpi/jwt_tool) and install its dependencies using pip. While this is a common security tool, it originates from a source not explicitly categorized as trusted.
[REMOTE_CODE_EXECUTION]: By instructing the installation of jwt_tool and executing it alongside user-provided data, the skill creates a path for remote code execution if the external tool or its dependencies are compromised.
[COMMAND_EXECUTION]: The skill makes heavy use of shell commands (curl, base64, git) and inline Python scripts (python3 -c) to decode tokens, perform network reconnaissance on target domains, and generate cryptographic keys. These capabilities are broad and grant the agent significant control over the local environment and network.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via JWT strings provided by the user in SKILL.md triggers.
Boundary markers: The instructions lack explicit boundary markers or warnings to ignore instructions embedded within the decoded JWT payloads.
Capability inventory: The agent has access to curl, python3, pip, and git across the provided scripts.
Sanitization: There is no evidence of sanitization or validation of the JWT content before it is processed or used in subsequent command arguments.

jwt-cracker