Identifies and reports vulnerabilities in JWT-based authentication systems.
npx skills add https://github.com/MAF2414/kyco --skill jwt-attack-surface
Please help me install this Agent Skill. Skill: jwt-attack-surface Source: https://github.com/MAF2414/kyco/tree/main/.claude/skills/jwt-attack-surface Command: npx skills add https://github.com/MAF2414/kyco --skill jwt-attack-surface
JWT-based authentication is common but often misconfigured, leading to vulnerabilities such as algorithm confusion, weak secrets, missing expiration/claims validation, and insecure token handling.
Provide a JWT security review of your authentication flow to surface algorithm vulnerabilities, weak secrets, and missing validations.
High-intent search queries and answers about installing and using this skill.
To audit JWT authentication for algorithm confusion, review token validation logic to ensure it rejects 'alg=none' and restricts accepted algorithms to a single expected type. This surfaces misconfigurations where multiple algorithms are improperly accepted, preventing signature bypass vulnerabilities.
During a JWT security review, validate the expiration (exp), issuer (iss), and audience (aud) claims alongside signature integrity. Missing validation of these claims allows expired or forged tokens to access APIs and microservices, compromising authentication system security.
To check if a JWT secret is cryptographically strong, verify it uses high entropy and sufficient length rather than predictable strings. Weak secrets allow attackers to brute-force signatures, so audits must identify and report them to enforce strong secret generation standards.
Yes, this security audit can identify missing token revocation and insecure token handling across microservices. It reviews storage and transmission practices, surfacing gaps in revocation flows that allow compromised JWTs to remain valid until natural expiration.
Yes, the JWT vulnerability report includes CWE mappings and severity ratings. It outputs structured findings that detail affected assets and map vulnerabilities to CWE references, supporting direct integration with existing risk trackers and remediation workflows.
The best way to secure JWT transmission and storage in APIs is to enforce strict validation and follow token handling best practices. Auditing storage mechanisms prevents unauthorized access, while verifying transmission channels ensures token authenticity and integrity across services.
klu-devSecure Java Spring Boot applications with JWT, role-based access, and OWASP dependency scanning.
jpoleyClassify security findings with OWASP, CWE, and CVSS v3.1 scoring.
pascallammersAnalyzes network traffic, authentication logs, and system configurations to detect anomalies and potential compromises.
jayjpatel9717Detect cross-site scripting vulnerabilities in web applications using pattern-based analysis.
