What problem does it solve? In CTF sandbox engagements, finding a JWT is easy, but proving exactly how its headers, key lookup, and claims turn into accepted identity or privilege is hard. This Skill provides a structured methodology to trace the full token-to-acceptance chain and isolate the decisive confusion bug without stopping at a successful decode. ## Core Features & Use Cases - Header and Key Selection Mapping: Records alg, kid, typ, jku, and embedded key material, and ties them to the actual key source such as static config, JWKS, local files, or caches. - Claim-to-Privilege Proof: Shows how subject, audience, issuer, tenant, scope, and role claims become sessions, route access, or backend privilege, separating parse success from authorization success. - Minimal Reproduction: Compresses findings into the smallest replayable token-to-acceptance sequence, with a canonical accepted path and a mutated path when confusion depends on a delta. - Use Case: During a CTF challenge, you capture a JWT with a suspicious kid field. Use this Skill to trace how the key is resolved, mutate the header, and prove the mutated token grants elevated role access. ## Quick Start Ask the assistant to analyze how a captured JWT's kid header and role claim are validated and accepted by the target service, after the ctf-sandbox-orchestrator has established sandbox assumptions.
