The Agent Skills Directory

[SAFE]: The instructions and code examples provided adhere to modern security standards for authentication. Specifically, it mandates asymmetric signing for production environments and provides a robust implementation for refresh token rotation that includes reuse detection and revocation of token families.
[INDIRECT_PROMPT_INJECTION]: The skill includes a feature to decode user-provided JWT strings for debugging purposes. While this represents a surface for untrusted data ingestion, the risk is minimal as the skill performs a static decode of claims (e.g., expiration, subject) and provides diagnostic feedback rather than executing any payload content. No capability for downstream command execution or file system modification is triggered by this data.
[SAFE]: The skill correctly recommends the use of environment variables for private key management and emphasizes hashing refresh tokens before database storage, preventing sensitive credential exposure within the skill instructions or generated code.

jwt-handler