payloads-jwt

The skill is explicitly an offensive JWT testing guide and provides actionable authentication-bypass, brute-force, and injection procedures, creating high security risk for an AI agent. The examples do not show credential theft, stealth, or exfiltration, and the `verify=False` finding is not a TLS issue. Third-party tool provenance and an unpinned Docker image add supply-chain risk.