offensive-jwt
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted source code, binaries, and configurations to find JWT vulnerabilities. This ingestion process creates a potential attack surface for indirect prompt injection if the analyzed data contains malicious instructions. However, this risk is inherent to the skill's primary purpose as a security audit tool and is documented here for awareness.
- Ingestion points: Identification of entrypoints and configuration files in the 'auth' domain (as stated in SKILL.md).
- Boundary markers: Absent.
- Capability inventory: Static analysis via grepping, AST analysis, binary disassembly, and runtime configuration verification (as stated in SKILL.md).
- Sanitization: Absent.
- [NO_CODE]: The skill package contains only Markdown documentation and YAML metadata. It does not include any scripts, binaries, or automated procedures that could execute commands on the host environment.
Audit Metadata