The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes JSON Web Tokens (JWT) provided in the Authorization header, which is an untrusted external data source.
Ingestion points: The JwtAuthenticationFilter.java template extracts tokens from the Authorization request header in the doFilterInternal method.
Boundary markers: The JwtService.java template validates the token signature using the jjwt library and performs manual checks on the type claim (expecting 'access') and expiration.
Capability inventory: The skill's primary function is to authenticate users, grant authorities, and establish the security context for the request lifecycle.
Sanitization: The code leverages the jjwt library to ensure token integrity, signature validity, and expiration before extracting user identities.
[CREDENTIALS_UNSAFE]: A hardcoded secret string is present in a file intended to demonstrate poor security practices.
Evidence: The file examples/bad-security-config.java contains private static final String SECRET = "mySecretKey12345678901234567890123456";.
Context: This finding is part of a negative example meant to teach developers which practices to avoid. The recommended templates correctly utilize environment variable placeholders (${JWT_SECRET}) for secret management.

spring-security-jwt