jwt-attack-methodology

该技能与其宣称目的基本一致，但目的本身是为 AI 代理提供 JWT 攻击与利用能力，属于高风险 offensive-security 技能。未见明确恶意窃取本机凭据或隐蔽外传，但存在明显的攻击性用途，以及中高供应链风险（个人 GitHub 编译执行、模糊的 pip 包来源）。应归类为 SUSPICIOUS/高风险，而非确认恶意软件。

This fragment is an actionable JWT exploitation guide covering token forgery, key substitution, injection, and weak-secret cracking, with examples that send forged tokens to target API endpoints. It does not show autonomous malware behavior or package-install execution, but use against systems without authorization could enable unauthorized access, so the content presents a security concern. Referenced domains include attacker[.]com and target[.]com; example local paths include /tmp/attacker_public.pem, /tmp/attacker_private.pem, /tmp/jwks.json, /tmp/jwt.txt, and password wordlists. No actual secret value or host credential theft is shown.

This module is not malware or an active exploitation script; however, it is a high-misuse-risk artifact because it explicitly drives generation of concrete JWT attack guidance (kid/jku manipulation and algorithm-confusion concepts) with targeted payload examples. Treat it as security-sensitive content and ensure strict controls on usage, distribution, and downstream model behavior.