Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or SSO systems during a security engagement.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilitiesnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilities -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill testing-for-json-web-token-vulnerabilities -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/testing-for-json-web-token-vulnerabilitiesgh skill install mukul975/Anthropic-Cybersecurity-Skills testing-for-json-web-token-vulnerabilitiesgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/testing-for-json-web-token-vulnerabilities ~/.claude/skills/testing-for-json-web-token-vulnerabilities # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/testing-for-json-web-token-vulnerabilities ~/.agents/skills/testing-for-json-web-token-vulnerabilities # Codex, Cursor, Gemini CLI, Copilot, OpenCode