Detect JWT implementation flaws across codebases and validate algorithm handling, secret strength, and claims.
npx skills add https://github.com/ersinkoc/security-check --skill sc-jwt
Please help me install this Agent Skill. Skill: sc-jwt Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-jwt Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-jwt
JWT implementations are error-prone and can enable token forgery, insecure storage, and missing validations. This Skill detects common JWT flaws across codebases and helps teams harden their authentication flows.
Ask me to scan your codebase for JWT implementation flaws and propose concrete fixes.
High-intent search queries and answers about installing and using this skill.
Scanning a codebase for JWT vulnerabilities involves validating algorithm handling to prevent alg:none confusion, verifying secret strength, and checking for missing exp, aud, and iss claims across server and client code.
Common JWT security flaws include algorithm confusion attacks, weak signing secrets, missing exp, aud, and iss claim validations, and insecure token storage in localStorage or sessionStorage, which can enable token forgery.
Yes, JWT token auditing applies across Node.js, Python, Java, and frontend frameworks. It analyzes server and client token usage, storage, and verification patterns to enforce algorithm validation and secure practices regardless of language.
Securing JWT storage in frontend applications requires avoiding localStorage and sessionStorage. Code analysis tools flag these insecure patterns and suggest secure alternatives to protect tokens from cross-site scripting attacks.
Missing exp claim validation causes JWT security issues because expired tokens are never rejected, allowing indefinite access. Auditing enforces proper exp, aud, and iss checks to ensure tokens are invalidated after their lifespan.
Preventing algorithm confusion in JWT verification requires enforcing explicit algorithm validation during token decoding. Scanning your codebase ensures the application rejects alg:none attacks and strictly expects the designated signing algorithm.
lluppesmsUpdate object-oriented component documentation from source code analysis.
layeddieImplement Elixir security patterns for authentication, authorization, and data protection.
HeldinhowImplements JWT authentication for secure API access with signed tokens.
fatihkanDetect authentication vulnerabilities in web applications and APIs.
