sc-jwt

Detect JWT implementation flaws across codebases and validate algorithm handling, secret strength, and claims.

56|5|Updated Apr 8, 2026

Search Tags:#security #authentication #vulnerability #jwt #code-analysis #web #token

Ready to run

npx skills add https://github.com/ersinkoc/security-check --skill sc-jwt

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sc-jwt
Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-jwt
Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-jwt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

JWT implementations are error-prone and can enable token forgery, insecure storage, and missing validations. This Skill detects common JWT flaws across codebases and helps teams harden their authentication flows.

Core Features & Use Cases

Detect algorithm confusion (alg:none), weak signing secrets, and missing exp/aud/iss validation across languages.
Flag insecure storage of tokens in localStorage or sessionStorage and suggest secure alternatives.
Provide actionable remediation guidance and example fixes for real-world projects.

Quick Start

Ask me to scan your codebase for JWT implementation flaws and propose concrete fixes.

Frequently Asked Questions about sc-jwt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find JWT implementation vulnerabilities in my codebase?▼

Scanning a codebase for JWT vulnerabilities involves validating algorithm handling to prevent alg:none confusion, verifying secret strength, and checking for missing exp, aud, and iss claims across server and client code.

What are common JWT security flaws in web applications?▼

Common JWT security flaws include algorithm confusion attacks, weak signing secrets, missing exp, aud, and iss claim validations, and insecure token storage in localStorage or sessionStorage, which can enable token forgery.

Does JWT token auditing work across Node.js, Python, and Java frameworks?▼

Yes, JWT token auditing applies across Node.js, Python, Java, and frontend frameworks. It analyzes server and client token usage, storage, and verification patterns to enforce algorithm validation and secure practices regardless of language.

What is the best way to secure JWT storage in frontend applications?▼

Securing JWT storage in frontend applications requires avoiding localStorage and sessionStorage. Code analysis tools flag these insecure patterns and suggest secure alternatives to protect tokens from cross-site scripting attacks.

Why does missing exp claim validation cause JWT security issues?▼

Missing exp claim validation causes JWT security issues because expired tokens are never rejected, allowing indefinite access. Auditing enforces proper exp, aud, and iss checks to ensure tokens are invalidated after their lifespan.

How to prevent algorithm confusion in JWT verification?▼

Preventing algorithm confusion in JWT verification requires enforcing explicit algorithm validation during token decoding. Scanning your codebase ensures the application rejects alg:none attacks and strictly expects the designated signing algorithm.