Map JWT issuance and verification patterns to identify insecure implementations.
npx skills add https://github.com/utkusen/sast-skills --skill sast-jwt
Please help me install this Agent Skill. Skill: sast-jwt Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-jwt Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-jwt
This Skill helps security engineers and developers identify insecure JWT implementations in a codebase by mapping JWT issuance and verification points and auditing common weaknesses.
Run the JWT recon phase to map issuance and verification sites, then run Phase 2 analysis to determine exploitable weaknesses.
High-intent search queries and answers about installing and using this skill.
To detect insecure JWT implementations, this Skill maps token issuance and verification patterns across multiple languages, identifying weaknesses like alg:none, weak secrets, and missing claim validation. Findings are output to markdown files for review.
During JWT security analysis, this tool checks for algorithm restriction flaws, missing signature verification, weak secrets, header manipulations, and missing claim validation by analyzing token flows and configuration patterns.
Yes, you can scan JWT authorization flows across multiple languages and frameworks. The Skill analyzes libraries, token flows, and claims to locate where tokens are read, verified, and validated throughout the codebase.
To start a JWT security assessment, run the two-phase approach: execute the recon phase to map token issuance and verification sites, then run analysis to determine exploitable weaknesses and generate the findings report.
The best way to audit missing claim validation and algorithm restrictions is using a two-phase JWT security assessment that maps configuration patterns and enforces checks for signature verification and claim validation across the codebase.
jvalinskyAudits Objective-C OAuth and DPoP implementations for protocol conformance and vulnerabilities.
riparinoAnalyze JWT implementations for misconfigurations and weak signing vulnerabilities.
ResgridScan .NET applications for security weaknesses with severity-rated findings.
YukiIto1999Test JWT tokens for algorithm confusion and authorization bypass vulnerabilities.
