Identify and exploit API authentication and JWT handling flaws.
npx skills add https://github.com/Yliken/ai4 --skill api-auth-and-jwt-abuse
Please help me install this Agent Skill. Skill: api-auth-and-jwt-abuse Source: https://github.com/Yliken/ai4/tree/main/skills/api-auth-and-jwt-abuse Command: npx skills add https://github.com/Yliken/ai4 --skill api-auth-and-jwt-abuse
This skill helps security teams and developers identify and exploit weaknesses in API authentication and JWT handling to reveal token trust boundaries and misconfigurations.
Provide a step-by-step security test plan for JWT and API token weaknesses.
High-intent search queries and answers about installing and using this skill.
To test JWT authentication and bearer tokens, you can identify and exploit flaws in API authentication handling to reveal token trust weaknesses. This covers checks for algorithm misconfigurations, key trust failures, and claim abuse across microservices and gateways.
The alg none vulnerability in JWT is an algorithm misconfiguration that allows token forgery by removing the signature requirement. It is tested by identifying and exploiting flaws in JWT handling to reveal token trust boundaries safely with auditable output.
You can bypass API rate limits by applying header spoofing scenarios and token abuse techniques to validate access control boundaries. This process tests the resilience of API authentication and documents the results with auditable output.
Yes, you can assess API keys and claims-based access control in microservices and client apps. The testing applies to services using bearer tokens across gateways to detect key trust failures and claim abuse.
The best way to perform a safe API token security test is to follow a step-by-step security test plan for JWT and API token weaknesses. This ensures safe, auditable testing with evidence collection and next routing to remediation playbooks.
The kid trust issue affects remote key fetch by allowing attackers to manipulate the key identifier header to point to an attacker-controlled remote key. Testing this flaw reveals misconfigurations in JWT handling and token trust boundaries.
AcczdyAssess REST and GraphQL API endpoints for OWASP API Security Top 10 vulnerabilities.
Forexgod21Map delegation chains and trust boundaries in multi-agent AI systems.
ok-helloworldIdentify API authentication flaws from JWT metadata and spoofable headers.
phoenixvcScan dependencies, detect secrets, and audit permissions for OWASP compliance.
