JWT Implementation Security (offensive-jwt)

Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

Overview

JSON Web Token (JWT) security assessment covering alg:none rejection, RS256-to-HS256 algorithm confusion, weak HMAC secret entropy, jwk/jku/x5u header injection, kid path/SQL injection, exp/nbf/aud/iss claim validation, and token revocation architecture. Use when auditing stateless authentication tokens.

Operational Workflow