Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-jwt-algorithm-confusion-attacknpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-jwt-algorithm-confusion-attack -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-jwt-algorithm-confusion-attack -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/exploiting-jwt-algorithm-confusion-attackgh skill install mukul975/Anthropic-Cybersecurity-Skills exploiting-jwt-algorithm-confusion-attackgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-jwt-algorithm-confusion-attack ~/.claude/skills/exploiting-jwt-algorithm-confusion-attack # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/exploiting-jwt-algorithm-confusion-attack ~/.agents/skills/exploiting-jwt-algorithm-confusion-attack # Codex, Cursor, Gemini CLI, Copilot, OpenCode